fkie_cve-2026-56831

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

GHSA-5vf4-452p-jjhf — Shopper: Negative discount values accepted and propagated through order calculation pipeline

Affected: Packagist: shopper/framework

## Summary

The Shopper Framework discount management functionality accepts negative discount values without server-side validation.

It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.

The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.

As a result, malformed discount records can influence financial calculations and produce unintended order totals.

---

## Affected Product

**Package:** shopper/framework

**Version Tested:** 2.8.1

---

## Vulnerability Type

* Business Logic Vulnerability * Improper Input Validation (CWE-20)

---

## Description

While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.

Example values tested:

```text -50.00 -99,999,999.00 ```

The application accepted these values without validation and stored them in the database.

Example records observed in the `sh_discounts` table:

This demonstrates that negative discount values are successfully persisted.

---

## Steps to Reproduce

### 1. Create a Discount

Navigate to:

```text /cpanel/discounts ```

Create a new discount with the…

Most recent entries from all

fkie_cve-2026-56831

GHSA-5vf4-452p-jjhf — Shopper: Negative discount values accepted and propagated through order calculation pipeline