Vulnerability-Lookup

CVE-2026-56831 (GCVE-0-2026-56831)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:42 – Updated: 2026-09-16 14:41

Title

Shopper: Negative discount values accepted and propagated through order calculation pipeline

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:41 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/528	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/967…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
shopperlabs	shopper	Affected: < 2.9.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56831",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:41:46.439666Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:41:52.114Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:42:09.495Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/528",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/528"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0"
        }
      ],
      "source": {
        "advisory": "GHSA-5vf4-452p-jjhf",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Negative discount values accepted and propagated through order calculation pipeline"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56831",
    "datePublished": "2026-09-15T17:42:09.495Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-16T14:41:52.114Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-56831",
      "date": "2026-09-29",
      "epss": "0.00435",
      "percentile": "0.35375"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "shopper",
                "vendor": "shopperlabs",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.9.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0."
          }
        ],
        "id": "CVE-2026-56831",
        "lastModified": "2026-09-16T15:17:38.200",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 3.6,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-56831",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:41:46.439666Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-09-15T18:17:25.213",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/shopperlabs/shopper/pull/528"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-56831",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-16T14:41:46.439666Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-16T14:41:33.248Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "shopper",
              "vendor": "shopperlabs",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.9.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-20",
                  "description": "CWE-20: Improper Input Validation",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-15T17:42:09.495Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
            },
            {
              "name": "https://github.com/shopperlabs/shopper/pull/528",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/shopperlabs/shopper/pull/528"
            },
            {
              "name": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41"
            },
            {
              "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0"
            }
          ],
          "source": {
            "advisory": "GHSA-5vf4-452p-jjhf",
            "discovery": "UNKNOWN"
          },
          "title": "Shopper: Negative discount values accepted and propagated through order calculation pipeline"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-56831",
        "datePublished": "2026-09-15T17:42:09.495Z",
        "dateReserved": "2026-06-23T14:55:09.117Z",
        "dateUpdated": "2026-09-15T17:42:09.495Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-56831

Vulnerability from fkie_nvd - Published: 2026-09-15 18:17 - Updated: 2026-09-16 15:17

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41
	security-advisories@github.com	https://github.com/shopperlabs/shopper/pull/528
	security-advisories@github.com	https://github.com/shopperlabs/shopper/releases/tag/v2.9.0
	security-advisories@github.com	https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0."
    }
  ],
  "id": "CVE-2026-56831",
  "lastModified": "2026-09-16T15:17:38.200",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-56831",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T14:41:46.439666Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-15T18:17:25.213",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/pull/528"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-5VF4-452P-JJHF

Vulnerability from github – Published: 2026-09-11 21:28 – Updated: 2026-09-11 21:28

Summary

Shopper: Negative discount values accepted and propagated through order calculation pipeline

Details

Summary

The Shopper Framework discount management functionality accepts negative discount values without server-side validation.

It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.

The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.

As a result, malformed discount records can influence financial calculations and produce unintended order totals.

Affected Product

Package: shopper/framework

Version Tested: 2.8.1

Vulnerability Type

Business Logic Vulnerability
Improper Input Validation (CWE-20)

Description

While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.

Example values tested:

-50.00
-99,999,999.00

The application accepted these values without validation and stored them in the database.

Example records observed in the sh_discounts table:

1 | QCZ5Y3HESM | fixed_amount | -5000
4 | TOZKAHCB4S | fixed_amount | -9999999900

This demonstrates that negative discount values are successfully persisted.

Steps to Reproduce

1. Create a Discount

Navigate to:

/cpanel/discounts

Create a new discount with the following values:

Type: fixed_amount
Value: -99999999

Save the discount.

2. Observe Successful Creation

The discount is accepted by the application and displayed in the administration interface.

Example:

Code: TOZKAHCB4S
Amount: -$99,999,999.00

3. Verify Database Persistence

Inspect the database:

select * from sh_discounts;

Observed entry:

TOZKAHCB4S | fixed_amount | -9999999900

Technical Analysis

Discount Calculation

File:

vendor/shopper/cart/src/Discounts/DiscountCalculator.php

Observed code:

$fixedAmount = $discount->value;

The value is later processed without validation:

$fixedAmount = min($fixedAmount, $applicableSubtotal);

When a negative value is supplied:

min(-9999999900, 10000)

returns:

-9999999900

allowing the negative value to continue through the calculation pipeline.

The resulting adjustment values are inserted into the database:

CartLineAdjustment::query()->insert($adjustments);

No validation was identified to ensure that discount amounts are positive before calculations occur.

Final Total Calculation

File:

vendor/shopper/cart/src/Pipelines/Calculate.php

Observed logic:

$context->total = max(
    0,
    $context->taxInclusive
        ? $context->subtotal - $context->discountTotal
        : $context->subtotal - $context->discountTotal + $context->taxTotal
);

Because negative discount values are allowed to reach this stage, financial calculations are performed using malformed discount data.

Example:

Subtotal      = 10000
DiscountTotal = -5000

Resulting calculation:

10000 - (-5000)

Result:

This demonstrates that negative discount values directly affect order total calculations.

Impact

The following was confirmed:

Negative discount values are accepted.
Negative discount values are persisted.
Negative discount values are processed by the discount calculation engine.
Negative discount values affect order total calculations.

Potential consequences include:

Incorrect pricing calculations.
Financial data integrity issues.
Unexpected order totals.
Violated assumptions within downstream pricing logic.
Future vulnerabilities if additional components assume discount values are always positive.

Because Shopper is a headless e-commerce administration framework and does not ship with a customer-facing storefront, it was not verified a customer-facing exploitation path.

However, malformed discount records currently propagate through pricing calculations without validation.

Recommendation

Implement server-side validation enforcing positive discount values before persistence and before entering the calculation pipeline.

Suggested validation:

Fixed Amount Discounts

value > 0

Percentage Discounts

0 < value <= 100

Additionally, existing discount records should be validated before calculation to prevent malformed data from influencing pricing logic.

Environment

Shopper Framework 2.8.1
Laravel 12.61.1
PHP 8.4.16
SQLite

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopper/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56831"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T21:28:00Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe Shopper Framework discount management functionality accepts negative discount values without server-side validation.\n\nIt was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.\n\nThe application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.\n\nAs a result, malformed discount records can influence financial calculations and produce unintended order totals.\n\n---\n\n## Affected Product\n\n**Package:** shopper/framework\n\n**Version Tested:** 2.8.1\n\n---\n\n## Vulnerability Type\n\n* Business Logic Vulnerability\n* Improper Input Validation (CWE-20)\n\n---\n\n## Description\n\nWhile reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.\n\nExample values tested:\n\n```text\n-50.00\n-99,999,999.00\n```\n\nThe application accepted these values without validation and stored them in the database.\n\nExample records observed in the `sh_discounts` table:\n\n```text\n1 | QCZ5Y3HESM | fixed_amount | -5000\n4 | TOZKAHCB4S | fixed_amount | -9999999900\n```\n\nThis demonstrates that negative discount values are successfully persisted.\n\n---\n\n## Steps to Reproduce\n\n### 1. Create a Discount\n\nLogin as an administrator.\n\nNavigate to:\n\n```text\n/cpanel/discounts\n```\n\nCreate a new discount with the following values:\n\n```text\nType: fixed_amount\nValue: -99999999\n```\n\nSave the discount.\n\n### 2. Observe Successful Creation\n\nThe discount is accepted by the application and displayed in the administration interface.\n\nExample:\n\n```text\nCode: TOZKAHCB4S\nAmount: -$99,999,999.00\n```\n\n### 3. Verify Database Persistence\n\nInspect the database:\n\n```sql\nselect * from sh_discounts;\n```\n\nObserved entry:\n\n```text\nTOZKAHCB4S | fixed_amount | -9999999900\n```\n\n---\n\n## Technical Analysis\n\n### Discount Calculation\n\nFile:\n\n```text\nvendor/shopper/cart/src/Discounts/DiscountCalculator.php\n```\n\nObserved code:\n\n```php\n$fixedAmount = $discount-\u003evalue;\n```\n\nThe value is later processed without validation:\n\n```php\n$fixedAmount = min($fixedAmount, $applicableSubtotal);\n```\n\nWhen a negative value is supplied:\n\n```php\nmin(-9999999900, 10000)\n```\n\nreturns:\n\n```php\n-9999999900\n```\n\nallowing the negative value to continue through the calculation pipeline.\n\nThe resulting adjustment values are inserted into the database:\n\n```php\nCartLineAdjustment::query()-\u003einsert($adjustments);\n```\n\nNo validation was identified to ensure that discount amounts are positive before calculations occur.\n\n---\n\n### Final Total Calculation\n\nFile:\n\n```text\nvendor/shopper/cart/src/Pipelines/Calculate.php\n```\n\nObserved logic:\n\n```php\n$context-\u003etotal = max(\n    0,\n    $context-\u003etaxInclusive\n        ? $context-\u003esubtotal - $context-\u003ediscountTotal\n        : $context-\u003esubtotal - $context-\u003ediscountTotal + $context-\u003etaxTotal\n);\n```\n\nBecause negative discount values are allowed to reach this stage, financial calculations are performed using malformed discount data.\n\nExample:\n\n```text\nSubtotal      = 10000\nDiscountTotal = -5000\n```\n\nResulting calculation:\n\n```text\n10000 - (-5000)\n```\n\nResult:\n\n```text\n15000\n```\n\nThis demonstrates that negative discount values directly affect order total calculations.\n\n---\n\n## Impact\n\nThe following was confirmed:\n\n* Negative discount values are accepted.\n* Negative discount values are persisted.\n* Negative discount values are processed by the discount calculation engine.\n* Negative discount values affect order total calculations.\n\nPotential consequences include:\n\n* Incorrect pricing calculations.\n* Financial data integrity issues.\n* Unexpected order totals.\n* Violated assumptions within downstream pricing logic.\n* Future vulnerabilities if additional components assume discount values are always positive.\n\nBecause Shopper is a headless e-commerce administration framework and does not ship with a customer-facing storefront, it was not verified a customer-facing exploitation path.\n\nHowever, malformed discount records currently propagate through pricing calculations without validation.\n\n---\n\n## Recommendation\n\nImplement server-side validation enforcing positive discount values before persistence and before entering the calculation pipeline.\n\nSuggested validation:\n\n### Fixed Amount Discounts\n\n```text\nvalue \u003e 0\n```\n\n### Percentage Discounts\n\n```text\n0 \u003c value \u003c= 100\n```\n\nAdditionally, existing discount records should be validated before calculation to prevent malformed data from influencing pricing logic.\n\n---\n\n## Environment\n\n```text\nShopper Framework 2.8.1\nLaravel 12.61.1\nPHP 8.4.16\nSQLite\n```",
  "id": "GHSA-5vf4-452p-jjhf",
  "modified": "2026-09-11T21:28:00Z",
  "published": "2026-09-11T21:28:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopperlabs/shopper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopper: Negative discount values accepted and propagated through order calculation pipeline"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-56831 (GCVE-0-2026-56831)

FKIE_CVE-2026-56831

GHSA-5VF4-452P-JJHF

Summary

Affected Product

Vulnerability Type

Description

Steps to Reproduce

1. Create a Discount

2. Observe Successful Creation

3. Verify Database Persistence

Technical Analysis

Discount Calculation

Final Total Calculation

Impact

Recommendation

Fixed Amount Discounts

Percentage Discounts

Environment

Tags

Sightings

Nomenclature

Related by attack behaviour