CVE-2026-56825: Shopper E-commerce Auth Bypass Vulnerability

CVE-2026-56825 Overview

CVE-2026-56825 is a missing authorization vulnerability [CWE-862] in Shopper, a headless e-commerce admin panel built on Laravel Livewire. The flaw affects versions prior to 2.9.2 in the packages/admin/src/Livewire/Components/Collection/CollectionProducts.php component. The component exposes Action::make('delete') and DeleteBulkAction::make() without enforcing the delete_collections permission. The public Collection $collection property also lacks the Livewire Locked attribute, making it client-mutable. An authenticated staff user with only the browse_collections permission can invoke removal actions against arbitrary collection identifiers.

Critical Impact
Low-privileged authenticated staff can detach products or empty arbitrary collections, disrupting catalog landing pages and active promotions.

Affected Products

Shopper Headless E-commerce Admin Panel versions prior to 2.9.2
packages/admin/src/Livewire/Components/Collection/CollectionProducts.php Livewire component
Shopper deployments where staff users hold the browse_collections permission

Discovery Timeline

2026-09-15 - CVE-2026-56825 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-56825

Vulnerability Analysis

The vulnerability resides in a Livewire component that manages products within a collection. Livewire components expose server-side PHP methods that clients invoke through browser events. The CollectionProducts component defined delete actions without applying the framework's authorization check for delete_collections. A user granted only read-oriented browse_collections capability can therefore trigger destructive operations. The impact scope aligns with tampering with catalog integrity rather than data confidentiality.

Root Cause

Two weaknesses combine to produce the flaw. First, Action::make('delete') and DeleteBulkAction::make() inside CollectionProducts.php skip the authorization gate that should validate delete_collections. Second, the public Collection $collection property is not decorated with the Livewire Locked attribute. Livewire treats public properties as client-mutable state by default. Together, these mistakes create a classic Missing Authorization pattern [CWE-862] on a mutable object binding.

Attack Vector

An authenticated attacker with browse_collections opens any accessible collection view. Using the Livewire wire protocol, the attacker submits an updated collection identifier alongside the delete or bulk-delete action call. The server accepts the substituted identifier, resolves the target collection, and performs the removal without checking the caller's permission. The result is product detachment from, or full clearing of, an attacker-chosen collection.

The upstream fix landed as part of pull request #570, titled "fix(admin): enforce authorization on unguarded settings and bulk actions," applied in commit bf72e27. The commit also normalizes localization files as shown below.

php

         'detail' => 'Detaylar',
         'detail_summary' => 'Bu konuma tanımlamayı kolaylaştıracak kısa bir ad verin. Bu adı ürünler gibi alanlarda göreceksiniz.',
         'address' => 'Konum adresi',
-        'address_summary' => "Konumunuzun eksiksiz bilgileri. Lütfen geçerli bilgiler girin, müşterileriniz için erişilebilir olabilir.",
+        'address_summary' => 'Konumunuzun eksiksiz bilgileri. Lütfen geçerli bilgiler girin, müşterileriniz için erişilebilir olabilir.',
         'set_default' => 'Varsayılan konum olarak ayarla',
         'set_default_summary' => 'Bu konumdaki envanter çevrimiçi satışa uygundur ve varsayılan olarak kullanılacaktır',
         'priority_summary' => 'Stok birden fazla konuma tahsis edilirken düşük değerler önce karşılanır.',

Source: GitHub Commit bf72e27

Detection Methods for CVE-2026-56825

Indicators of Compromise

Unexpected removal of products from collections attributed to staff users lacking delete_collections.
Empty collections previously populated for landing pages or promotions.
Livewire update requests referencing CollectionProducts with collection identifiers the user does not normally curate.

Detection Strategies

Audit Laravel application logs for livewire/update calls invoking delete or deleteBulk actions from users without the delete_collections role.
Correlate collection-modification database events with the acting user's permission set to surface authorization mismatches.
Review Shopper version banners across environments to identify installations still on releases prior to 2.9.2.

Monitoring Recommendations

Forward web server and application logs to a centralized analytics platform for query against Livewire endpoint activity.
Alert on bulk product detachments occurring outside normal merchandising windows.
Track changes to collection product counts and flag drops that exceed a defined threshold.

How to Mitigate CVE-2026-56825

Immediate Actions Required

Upgrade Shopper to version 2.9.2 or later across every environment.
Temporarily revoke the browse_collections permission from non-essential staff accounts until patching completes.
Review audit trails for collection modifications since the vulnerable component was deployed.

Patch Information

The issue is fixed in Shopper 2.9.2. The upstream repair enforces authorization on the previously unguarded delete and bulk delete actions and secures the mutable component state. Details are available in the GitHub Security Advisory GHSA-2cg9-97gq-9mqp, Pull Request #570, and the Shopper v2.9.2 Release.

Workarounds

If immediate upgrade is not feasible, restrict access to the Shopper admin panel via network controls or reverse-proxy rules.
Limit collection-management roles to trusted administrators pending the patch rollout.
Snapshot production database collection tables to enable rapid restoration of affected catalogs.

bash

# Update Shopper via Composer to the patched release
composer require shopper/framework:^2.9.2
php artisan view:clear
php artisan config:clear