Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.

Affected: Packagist: shopper/framework

## Title

Missing authorization on Media sub-form store action allows unpermissioned product media update

## Description

A lack of authorization control on the `store()` method was found in `packages/admin/src/Livewire/Components/Products/Form/Media.php`. The security fix released for GHSA-h4mp-g9c6-xwph added `#[Locked]` to the `$product` property in this file but did not add an `authorize()` call to `store()`. The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only `browse_products`, can invoke `store()` on this component to replace the thumbnail and gallery images for any product without holding `edit_products`. Because `$product` is now `#[Locked]`, the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent, so the write succeeds against whichever product the component was initialized for.

## Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Score: 6.5 (Medium)

## Affected files

- `packages/admin/src/Livewire/Components/Products/Form/Media.php:64-76`

```php // Lines 64-76 - store() with no authorize() call public function store(): void { $this->validate();

$this->product->update($this->form->getState()); // overwrites thumbnail + gallery media…