Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-56831 (GCVE-0-2026-56831)

Vulnerability from nvd – Published: 2026-09-15 17:42 – Updated: 2026-09-16 14:41

Title

Shopper: Negative discount values accepted and propagated through order calculation pipeline

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:41 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/528	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/967…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56831",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:41:46.439666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:41:52.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:42:09.495Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/528",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/528"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5vf4-452p-jjhf",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Negative discount values accepted and propagated through order calculation pipeline"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56831",
    "datePublished": "2026-09-15T17:42:09.495Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-16T14:41:52.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56830 (GCVE-0-2026-56830)

Vulnerability from nvd – Published: 2026-09-15 17:43 – Updated: 2026-09-15 19:44

Title

Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:57 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56830",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:57:33.615806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:44:12.701Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:43:04.968Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-99h5-jhh7-v3r3",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56830",
    "datePublished": "2026-09-15T17:43:04.968Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-15T19:44:12.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56829 (GCVE-0-2026-56829)

Vulnerability from nvd – Published: 2026-09-15 17:40 – Updated: 2026-09-15 19:04

Title

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 19:04 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56829",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T19:04:25.446927Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:04:52.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:40:01.302Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-g3f9-g5vj-p62f",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56829",
    "datePublished": "2026-09-15T17:40:01.302Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-15T19:04:52.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56827 (GCVE-0-2026-56827)

Vulnerability from nvd – Published: 2026-09-15 17:41 – Updated: 2026-09-15 18:38

Title

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56827",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:34:31.625515Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T18:38:02.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make(\u0027enabled\u0027) or BulkAction::make(\u0027disabled\u0027) to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:41:15.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-243p-f3cv-c5wh",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56827",
    "datePublished": "2026-09-15T17:41:15.126Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-09-15T18:38:02.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56825 (GCVE-0-2026-56825)

Vulnerability from nvd – Published: 2026-09-15 17:38 – Updated: 2026-09-16 14:40

Title

Shopper: Missing authorization on product removal actions in CollectionProducts component

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:40 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56825",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:40:08.824151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:40:15.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make(\u0027delete\u0027) and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:38:42.928Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2cg9-97gq-9mqp",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing authorization on product removal actions in CollectionProducts component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56825",
    "datePublished": "2026-09-15T17:38:42.928Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-09-16T14:40:15.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47743 (GCVE-0-2026-47743)

Vulnerability from nvd – Published: 2026-07-23 17:20 – Updated: 2026-07-23 18:19

Title

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 18:18 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47743",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T18:18:55.397643Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T18:19:03.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `\u003csvg\u003e` context that does not interpret event handlers. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T17:20:25.550Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-hr9v-r8r2-hg7j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-hr9v-r8r2-hg7j"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-hr9v-r8r2-hg7j",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Multiple data integrity and disclosure issues in admin Livewire components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47743",
    "datePublished": "2026-07-23T17:20:25.550Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-07-23T18:19:03.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47745 (GCVE-0-2026-47745)

Vulnerability from nvd – Published: 2026-05-29 17:55 – Updated: 2026-05-29 18:43

Title

Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 18:43 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T18:43:10.297571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T18:43:47.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T17:55:38.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-fxqw-97cc-7g5c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-fxqw-97cc-7g5c"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-fxqw-97cc-7g5c",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47745",
    "datePublished": "2026-05-29T17:55:38.873Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-05-29T18:43:47.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47744 (GCVE-0-2026-47744)

Vulnerability from nvd – Published: 2026-05-29 17:58 – Updated: 2026-05-29 21:38

Title

Shopper: Authorization bypass and RBAC privilege escalation in team settings

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 21:38 UTC

CWE

CWE-269 - Improper Privilege Management
CWE-285 - Improper Authorization

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T21:38:07.299741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T21:38:15.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T17:58:21.342Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-c3qp-2ggw-xjg7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-c3qp-2ggw-xjg7"
        }
      ],
      "source": {
        "advisory": "GHSA-c3qp-2ggw-xjg7",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Authorization bypass and RBAC privilege escalation in team settings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47744",
    "datePublished": "2026-05-29T17:58:21.342Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-05-29T21:38:15.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47742 (GCVE-0-2026-47742)

Vulnerability from nvd – Published: 2026-05-29 18:00 – Updated: 2026-06-01 15:19

Title

Shopper: Missing authorization on Product admin Livewire sub-form components

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-01 15:19 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T15:19:44.808785Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T15:19:52.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product\u0027s pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T18:00:31.896Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-h4mp-g9c6-xwph",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-h4mp-g9c6-xwph"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-h4mp-g9c6-xwph",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing authorization on Product admin Livewire sub-form components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47742",
    "datePublished": "2026-05-29T18:00:31.896Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-06-01T15:19:52.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47741 (GCVE-0-2026-47741)

Vulnerability from nvd – Published: 2026-05-29 18:02 – Updated: 2026-05-29 19:18

Title

Shopper: Race condition on Discount.usage_limit allows silent over-redemption

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 19:18 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/issues/510	x_refsource_MISC
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47741",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T19:18:13.721164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T19:18:41.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/issues/510"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount\u0027s total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T18:02:13.168Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-9rh9-hf3w-9fgg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-9rh9-hf3w-9fgg"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/issues/510",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/issues/510"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-9rh9-hf3w-9fgg",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Race condition on Discount.usage_limit allows silent over-redemption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47741",
    "datePublished": "2026-05-29T18:02:13.168Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-05-29T19:18:41.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47740 (GCVE-0-2026-47740)

Vulnerability from nvd – Published: 2026-05-29 18:03 – Updated: 2026-06-02 01:50

Title

Shopper: Authorization bypass in multiple Livewire admin components

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-02 01:50 UTC

CWE

CWE-285 - Improper Authorization
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T01:50:41.879905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T01:50:53.411Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T18:03:54.473Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-f946-9qp6-vgch",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Authorization bypass in multiple Livewire admin components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47740",
    "datePublished": "2026-05-29T18:03:54.473Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-06-02T01:50:53.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56830 (GCVE-0-2026-56830)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:43 – Updated: 2026-09-15 19:44

Title

Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:57 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56830",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:57:33.615806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:44:12.701Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:43:04.968Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-99h5-jhh7-v3r3",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56830",
    "datePublished": "2026-09-15T17:43:04.968Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-15T19:44:12.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56831 (GCVE-0-2026-56831)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:42 – Updated: 2026-09-16 14:41

Title

Shopper: Negative discount values accepted and propagated through order calculation pipeline

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:41 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/528	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/967…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56831",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:41:46.439666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:41:52.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:42:09.495Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/528",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/528"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5vf4-452p-jjhf",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Negative discount values accepted and propagated through order calculation pipeline"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56831",
    "datePublished": "2026-09-15T17:42:09.495Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-16T14:41:52.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56827 (GCVE-0-2026-56827)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:41 – Updated: 2026-09-15 18:38

Title

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:34 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56827",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:34:31.625515Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T18:38:02.221Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make(\u0027enabled\u0027) or BulkAction::make(\u0027disabled\u0027) to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:41:15.126Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-243p-f3cv-c5wh"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-243p-f3cv-c5wh",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56827",
    "datePublished": "2026-09-15T17:41:15.126Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-09-15T18:38:02.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56829 (GCVE-0-2026-56829)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:40 – Updated: 2026-09-15 19:04

Title

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 19:04 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56829",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T19:04:25.446927Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:04:52.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:40:01.302Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-g3f9-g5vj-p62f"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-g3f9-g5vj-p62f",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56829",
    "datePublished": "2026-09-15T17:40:01.302Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-15T19:04:52.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56825 (GCVE-0-2026-56825)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:38 – Updated: 2026-09-16 14:40

Title

Shopper: Missing authorization on product removal actions in CollectionProducts component

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:40 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56825",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:40:08.824151Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:40:15.792Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make(\u0027delete\u0027) and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:38:42.928Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-2cg9-97gq-9mqp"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-2cg9-97gq-9mqp",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing authorization on product removal actions in CollectionProducts component"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56825",
    "datePublished": "2026-09-15T17:38:42.928Z",
    "dateReserved": "2026-06-23T14:55:09.116Z",
    "dateUpdated": "2026-09-16T14:40:15.792Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47743 (GCVE-0-2026-47743)

Vulnerability from cvelistv5 – Published: 2026-07-23 17:20 – Updated: 2026-07-23 18:19

Title

Shopper: Multiple data integrity and disclosure issues in admin Livewire components

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `<svg>` context that does not interpret event handlers. No known workarounds are available.

Severity

8.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 18:18 UTC

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47743",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T18:18:55.397643Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T18:19:03.439Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the `#[Locked]` attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. Second, `Customers/Create::store()` re-passed a `Hidden` `_password` form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. Finally, the product barcode field was rendered through `DNS1DFacade::getBarcodeHTML()` with `{!! !!}`. An attacker with `edit_products` permission could persist malicious payload in the barcode field that would execute in the browser of any admin user viewing that product, enabling session theft and privileged-action chaining. Starting in v2.8.0, all vulnerable Livewire model identifiers are now marked `#[Locked]`; `Customers/Create` no longer round-trips the password through a Hidden form field; the plaintext password is hashed at action boundary and never returned to the client; and the product barcode rendering now escapes the value before passing it to the barcode generator and the output is wrapped in an `\u003csvg\u003e` context that does not interpret event handlers. No known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-23T17:20:25.550Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-hr9v-r8r2-hg7j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-hr9v-r8r2-hg7j"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-hr9v-r8r2-hg7j",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Multiple data integrity and disclosure issues in admin Livewire components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47743",
    "datePublished": "2026-07-23T17:20:25.550Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-07-23T18:19:03.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47740 (GCVE-0-2026-47740)

Vulnerability from cvelistv5 – Published: 2026-05-29 18:03 – Updated: 2026-06-02 01:50

Title

Shopper: Authorization bypass in multiple Livewire admin components

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-02 01:50 UTC

CWE

CWE-285 - Improper Authorization
CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-02T01:50:41.879905Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-02T01:50:53.411Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail actions cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission and did not require edit_orders. capturePayment could trigger an actual PSP capture (real funds movement). The order shipments table actions mark delivered and edit tracking were callable with the read-only browse_orders permission. A user with read access to orders could therefore alter the lifecycle of every order in the panel and trigger real-world payment captures. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T18:03:54.473Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f946-9qp6-vgch"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-f946-9qp6-vgch",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Authorization bypass in multiple Livewire admin components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47740",
    "datePublished": "2026-05-29T18:03:54.473Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-06-02T01:50:53.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47741 (GCVE-0-2026-47741)

Vulnerability from cvelistv5 – Published: 2026-05-29 18:02 – Updated: 2026-05-29 19:18

Title

Shopper: Race condition on Discount.usage_limit allows silent over-redemption

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 19:18 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M mitre root

References

3 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/issues/510	x_refsource_MISC
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47741",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T19:18:13.721164Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T19:18:41.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/issues/510"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount\u0027s total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied to price_amount while the counter blocked at usage_limit. The merchant had no signal that an over-redemption had occurred. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T18:02:13.168Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-9rh9-hf3w-9fgg",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-9rh9-hf3w-9fgg"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/issues/510",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/issues/510"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-9rh9-hf3w-9fgg",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Race condition on Discount.usage_limit allows silent over-redemption"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47741",
    "datePublished": "2026-05-29T18:02:13.168Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-05-29T19:18:41.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47742 (GCVE-0-2026-47742)

Vulnerability from cvelistv5 – Published: 2026-05-29 18:00 – Updated: 2026-06-01 15:19

Title

Shopper: Missing authorization on Product admin Livewire sub-form components

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-01 15:19 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-01T15:19:44.808785Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-01T15:19:52.067Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product\u0027s pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T18:00:31.896Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-h4mp-g9c6-xwph",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-h4mp-g9c6-xwph"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-h4mp-g9c6-xwph",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing authorization on Product admin Livewire sub-form components"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47742",
    "datePublished": "2026-05-29T18:00:31.896Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-06-01T15:19:52.067Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47744 (GCVE-0-2026-47744)

Vulnerability from cvelistv5 – Published: 2026-05-29 17:58 – Updated: 2026-05-29 21:38

Title

Shopper: Authorization bypass and RBAC privilege escalation in team settings

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 21:38 UTC

CWE

CWE-269 - Improper Privilege Management
CWE-285 - Improper Authorization

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T21:38:07.299741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T21:38:15.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system. Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. Settings/Team/RolePermission gated its write actions on the read-only view_users permission. Any user holding view_users could grant themselves or any other user arbitrary permissions, including manage_users and edit_orders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269: Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T17:58:21.342Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-c3qp-2ggw-xjg7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-c3qp-2ggw-xjg7"
        }
      ],
      "source": {
        "advisory": "GHSA-c3qp-2ggw-xjg7",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Authorization bypass and RBAC privilege escalation in team settings"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47744",
    "datePublished": "2026-05-29T17:58:21.342Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-05-29T21:38:15.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47745 (GCVE-0-2026-47745)

Vulnerability from cvelistv5 – Published: 2026-05-29 17:55 – Updated: 2026-05-29 18:43

Title

Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 18:43 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/511	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.8.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47745",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T18:43:10.297571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T18:43:47.804Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.8.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could disable every payment method on the store, disable or alter the default currency, or disable carriers. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. This vulnerability is fixed in 2.8.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-29T17:55:38.873Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-fxqw-97cc-7g5c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-fxqw-97cc-7g5c"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/511",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/511"
        }
      ],
      "source": {
        "advisory": "GHSA-fxqw-97cc-7g5c",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-47745",
    "datePublished": "2026-05-29T17:55:38.873Z",
    "dateReserved": "2026-05-19T22:16:39.504Z",
    "dateUpdated": "2026-05-29T18:43:47.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by shopperlabs

CVE-2026-56831 (GCVE-0-2026-56831)

CVE-2026-56830 (GCVE-0-2026-56830)

CVE-2026-56829 (GCVE-0-2026-56829)

CVE-2026-56827 (GCVE-0-2026-56827)

CVE-2026-56825 (GCVE-0-2026-56825)

CVE-2026-47743 (GCVE-0-2026-47743)

CVE-2026-47745 (GCVE-0-2026-47745)

CVE-2026-47744 (GCVE-0-2026-47744)

CVE-2026-47742 (GCVE-0-2026-47742)

CVE-2026-47741 (GCVE-0-2026-47741)

CVE-2026-47740 (GCVE-0-2026-47740)

CVE-2026-56830 (GCVE-0-2026-56830)

CVE-2026-56831 (GCVE-0-2026-56831)

CVE-2026-56827 (GCVE-0-2026-56827)

CVE-2026-56829 (GCVE-0-2026-56829)

CVE-2026-56825 (GCVE-0-2026-56825)

CVE-2026-47743 (GCVE-0-2026-47743)

CVE-2026-47740 (GCVE-0-2026-47740)

CVE-2026-47741 (GCVE-0-2026-47741)

CVE-2026-47742 (GCVE-0-2026-47742)

CVE-2026-47744 (GCVE-0-2026-47744)

CVE-2026-47745 (GCVE-0-2026-47745)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

22 vulnerabilities by shopperlabs

CVE-2026-56831 (GCVE-0-2026-56831)

CVE-2026-56830 (GCVE-0-2026-56830)

CVE-2026-56829 (GCVE-0-2026-56829)

CVE-2026-56827 (GCVE-0-2026-56827)

CVE-2026-56825 (GCVE-0-2026-56825)

CVE-2026-47743 (GCVE-0-2026-47743)

CVE-2026-47745 (GCVE-0-2026-47745)

CVE-2026-47744 (GCVE-0-2026-47744)

CVE-2026-47742 (GCVE-0-2026-47742)

CVE-2026-47741 (GCVE-0-2026-47741)

CVE-2026-47740 (GCVE-0-2026-47740)

CVE-2026-56830 (GCVE-0-2026-56830)

CVE-2026-56831 (GCVE-0-2026-56831)

CVE-2026-56827 (GCVE-0-2026-56827)

CVE-2026-56829 (GCVE-0-2026-56829)

CVE-2026-56825 (GCVE-0-2026-56825)

CVE-2026-47743 (GCVE-0-2026-47743)

CVE-2026-47740 (GCVE-0-2026-47740)

CVE-2026-47741 (GCVE-0-2026-47741)

CVE-2026-47742 (GCVE-0-2026-47742)

CVE-2026-47744 (GCVE-0-2026-47744)

CVE-2026-47745 (GCVE-0-2026-47745)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.