Read the docs
TI-2026-83412 Aliases CVE-2026-62989

Missing authorization in Shopper lets staff delete product variants

Priority HIGH 68CWE-285Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285.

Summary

Shopper, a headless e-commerce admin panel by shopperlabs, is affected before 2.10.0. Its Variants Livewire component does not check authorization for delete actions (CWE-862), so an authenticated staff user with edit_products can permanently delete product variants without the delete_product_variants permission, individually or in bulk. Deleting variants can disrupt storefront product pages, the cart and checkout.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00279 20th percentileScored 2026-11-07
Fix Fixed shopper (shopperlabs): 2.10.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
shopperlabsshopperbefore 2.10.02.10.0Patch availableCNA
  • shopper Vendorshopperlabs Affected before 2.10.0 Fixed in 2.10.0 Patch available CNA

Remediation

Upgrade Shopper to version 2.10.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA shopper (shopperlabs) Fixed in 2.10.0

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-62989
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → HIGH

References

Other 4

  • TI-2026-83413 Stored XSS via SVG and HTML uploads in Shopper admin panel CVSS 3.1HIGH 8.7
  • TI-2026-40978 Missing authorization in shopperlabs shopper CVSS 3.1HIGH 8.1
  • TI-2026-40979 Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component CVSS 3.1HIGH 8.1
  • TI-2026-40977 Shopper: Missing authorization on product removal actions in CollectionProducts component CVSS 3.1HIGH 8.1
  • TI-2026-40981 Shopper: Negative discount values accepted and propagated through order calculation pipeline CVSS 3.1MEDIUM 6.5
  • TI-2026-35241 Shopper: Race condition on Discount.usage_limit allows silent over-redemption CVSS 3.1MEDIUM 5.9
See all 16 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences