fkie_cve-2026-56829

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2.

GHSA-g3f9-g5vj-p62f — Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Affected: Packagist: shopper/framework

## Title

Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

## Description

A lack of authorization control was discovered in the `stockAction()` method in `packages/admin/src/Livewire/Components/Products/VariantStock.php`. The component exposes a `public $variant` property without the `#[Locked]` attribute, so the variant ID is client-mutable via the Livewire wire payload. The `stockAction()` returns an Action with no `->authorize(...)` chain, meaning any authenticated admin-panel session, including browse-only staff who hold zero edit permissions, can call this action to adjust inventory levels for any product variant. The combination of missing authorization and an unlocked model binding lets the attacker both bypass the permission gate and redirect the mutation to an arbitrary variant in the database.

## Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Score: 8.1 (High)

## Affected files

- `packages/admin/src/Livewire/Components/Products/VariantStock.php:34-91`

```php // Line 34 - unprotected, client-mutable variant binding public $variant;

// Lines 36-91 - no ->authorize(...) on the Action public function stockAction(): Action { return Action::make('stock') ->label(__('shopper::forms.actions.update')) ->color('gray') ->icon(Untitledui::Package) ->modalHeading(__('shopper::pages/products.modals.variants.title')) ->modalWidth(Width::Large) ->schema([…

Most recent entries from all

fkie_cve-2026-56829

GHSA-g3f9-g5vj-p62f — Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component