Read the docs
TI-2026-73472 Aliases CVE-2026-56826

Missing authorization in Shopper lets users delete store settings

Priority MEDIUM 58CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Shopper from 2.0.0 before 2.9.2 does not enforce server-side delete authorization in several Settings Livewire components for shipping zones, tax zones and tax rates (CWE-862). An authenticated user who can reach the Settings pages with only the access_setting permission can call these delete actions directly through the Livewire endpoint. Deleting carrier options, shipping zones, tax zones and tax rates disrupts checkout shipping and tax calculation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00338 27th percentileScored 2026-11-07
Fix Fixed shopper (shopperlabs): 2.9.2shopper/framework (Packagist): 2.9.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
shopperlabsshopper2.0.0 to before 2.9.22.9.2Patch availableCNA
—shopper/framework (Packagist)2.0.0 to before 2.9.22.9.2Patch availableGHSA-f7h9-qv4x-9x57
  • shopper Vendorshopperlabs Affected 2.0.0 to before 2.9.2 Fixed in 2.9.2 Patch available CNA
  • shopper/framework (Packagist) Vendor— Affected 2.0.0 to before 2.9.2 Fixed in 2.9.2 Patch available GHSA-f7h9-qv4x-9x57

Remediation

Upgrade shopper/framework to version 2.9.2, which fixes this issue. The sources list no fixed version for shopper.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA shopper (shopperlabs) Fixed in 2.9.2
  • Fix · GHSA-f7h9-qv4x-9x57 shopper/framework (Packagist) Fixed in 2.9.2 Advisory →

Timeline

  1. 2026-10-13 Threatist record created from CVE-2026-56826
  2. 2026-10-14 Priority changed: MEDIUM → LOW
  3. 2026-10-18 CISA SSVC decision points changed
  4. 2026-10-18 Priority changed: LOW → MEDIUM

References

Other 5

  • TI-2026-83413 Stored XSS via SVG and HTML uploads in Shopper admin panel CVSS 3.1HIGH 8.7
  • TI-2026-40978 Missing authorization in shopperlabs shopper CVSS 3.1HIGH 8.1
  • TI-2026-83412 Missing authorization in Shopper lets staff delete product variants CVSS 3.1HIGH 8.1
  • TI-2026-40979 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component CVSS 3.1HIGH 8.1
  • TI-2026-40977 Shopper: Missing authorization on product removal actions in CollectionProducts component CVSS 3.1HIGH 8.1
  • TI-2026-40981 Shopper: Negative discount values accepted and propagated through order calculation pipeline CVSS 3.1MEDIUM 6.5
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences