CVE-2026-47742: Shopper Auth Bypass Vulnerability

CVE-2026-47742 Overview

CVE-2026-47742 is a missing authorization vulnerability [CWE-862] in Shopper, a headless e-commerce admin panel built on Laravel Livewire. Versions prior to 2.8.0 expose sub-form Livewire components in the product editor without authorization checks on their store() method. Any authenticated panel user can modify product pricing, stock levels, SEO metadata, shipping dimensions, and attached media without holding the edit_products permission. The affected components also accept the product ID as an unprotected public Livewire property, allowing attackers to target arbitrary products by tampering with the wire payload. The maintainers fixed the issue in version 2.8.0.

Critical Impact

Any authenticated low-privilege user can tamper with product pricing, inventory, SEO data, shipping details, and media attachments across the entire catalog.

Affected Products

• Shopper (shopperlabs/shopper) versions prior to 2.8.0
• Edit, Inventory, Seo, Shipping, and Files Livewire sub-form components in the product editor
• Laravel applications integrating the Shopper admin panel

Discovery Timeline

• 2026-05-29 - CVE-2026-47742 published to the National Vulnerability Database (NVD)
• 2026-05-29 - Last updated in NVD database

Technical Details for CVE-2026-47742

Vulnerability Analysis

The vulnerability resides in the Livewire components that back the product editor sub-forms in Shopper. Each component exposes a store() method intended to persist changes for a single product section. These methods do not perform authorization checks against the edit_products ability before applying mutations. The components also declare the product ID as a public Livewire property without the #[Locked] attribute, which is required to prevent client-side tampering with bound properties.

Successful exploitation lets an authenticated user with any panel role overwrite pricing, stock quantities, SEO fields, shipping dimensions, and media attachments. The attacker can change which product is targeted by modifying the wire payload sent from the browser, allowing catalog-wide manipulation rather than only products the user can normally view.

Root Cause

The root cause is a missing authorization control [CWE-862] combined with an insecure mass-assignable property pattern. Sub-form Livewire components inherit no ability check from their parent and never re-evaluate the user's edit_products permission inside the store() method. The unlocked product ID property breaks Livewire's server-side state expectations, allowing client-supplied identifiers to flow into persistence logic.

Attack Vector

An attacker requires only a valid authenticated session on the Shopper admin panel. After loading any view that mounts an affected sub-form component, the attacker intercepts the outgoing Livewire request and replaces the bound product identifier and field values with attacker-chosen content. The server processes the store() call without verifying ability or ownership, committing the change to the target product. No user interaction beyond the attacker's own session is required, and the network attack surface is reachable over standard HTTP.

No public proof-of-concept code is currently available. See the GitHub Security Advisory and the GitHub Pull Request for the maintainer's technical description.

Detection Methods for CVE-2026-47742

Indicators of Compromise

• Unexpected modifications to product price, stock, seo, shipping, or media records performed by users who do not hold the edit_products ability.
• Livewire update requests to /livewire/update referencing product editor sub-form components from low-privilege accounts.
• Audit log entries showing product mutations without a corresponding navigation to the product edit page in the same session.

Detection Strategies

• Review application and database audit trails for product updates correlated with user roles that lack edit_products.
• Instrument the affected Livewire store() methods to log the authenticated user, target product ID, and changed attributes for retroactive analysis.
• Compare current product pricing and inventory snapshots against historical baselines to surface unauthorized drift.

Monitoring Recommendations

• Forward Laravel application logs and web server access logs to a centralized analytics platform for correlation against role data.
• Alert on Livewire callMethod payloads where the product property differs from the product loaded by the parent component.
• Track sudden spikes in product update volume per user account to detect scripted abuse of the store() endpoints.

How to Mitigate CVE-2026-47742

Immediate Actions Required

• Upgrade shopperlabs/shopper to version 2.8.0 or later using composer update shopperlabs/shopper.
• Audit user accounts with panel access and remove any that are no longer required, reducing the population of potential abusers.
• Review recent product changes and restore correct pricing, stock, SEO, shipping, and media values where tampering is suspected.

Patch Information

The maintainers fixed CVE-2026-47742 in Shopper version 2.8.0. The fix adds edit_products ability checks to the store() methods of the Edit, Inventory, Seo, Shipping, and Files sub-form Livewire components and marks the product ID property with #[Locked] to prevent client-side tampering. Implementation details are available in the GitHub Pull Request.

Workarounds

• If upgrading immediately is not possible, restrict panel access to roles that already hold edit_products, accepting that lower roles will lose admin functionality.
• Place the Shopper admin panel behind an additional authentication layer or IP allowlist to reduce exposure of authenticated endpoints.
• Apply a temporary middleware or policy that gates Livewire update requests targeting the affected components against the edit_products ability.

# Configuration example
composer require shopperlabs/shopper:^2.8.0
php artisan view:clear
php artisan config:clear