CVE-2026-56826: Shopper E-commerce Auth Bypass Vulnerability

CVE-2026-56826 Overview

CVE-2026-56826 is a missing authorization vulnerability in Shopper, a headless e-commerce admin panel built on Laravel Livewire. The flaw affects versions 2.0.0 through 2.9.1 and allows authenticated users with only the access_setting permission to invoke destructive delete actions. Server-side authorization checks are absent in four Livewire components under packages/admin/src/Livewire/Components/Settings/. Attackers can delete carrier options, shipping zones, tax zones, and tax rates. The result disrupts checkout shipping, payment-method mapping, and tax calculation. The issue is categorized under [CWE-862] Missing Authorization and is fixed in Shopper 2.9.2.

Critical Impact
Authenticated low-privilege users can destroy shipping and tax configuration data, breaking checkout, payment mapping, and tax calculation across the storefront.

Affected Products

Shopper Headless E-commerce Admin Panel versions 2.0.0 through 2.9.1
Laravel Livewire Settings components for Zones and Taxes
Downstream storefronts relying on Shopper for shipping and tax configuration

Discovery Timeline

2026-10-13 - CVE-2026-56826 published to NVD
2026-10-13 - Last updated in NVD database
Shopper v2.9.2 - Vendor released patched version via Shopper Release v2.9.2

Technical Details for CVE-2026-56826

Vulnerability Analysis

Shopper exposes administrative actions through Laravel Livewire endpoints. Four Livewire components handle destructive operations on shipping and tax configuration but do not call server-side authorization gates before executing deletes. Any authenticated user who can reach the Settings pages with the access_setting permission can trigger these delete methods by invoking the Livewire endpoint directly. The vulnerability maps to [CWE-862] Missing Authorization, where privilege separation exists in the UI but is never enforced in the backend action handlers. Although confidentiality is unaffected, integrity and availability of core e-commerce flows are at risk.

Root Cause

The missing authorization is located in the following files:

packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php
packages/admin/src/Livewire/Components/Settings/Zones/Detail.php
packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php
packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php

Each component exposes delete actions without calling Laravel policy or gate checks. The UI relies on view-layer guards instead of enforcing authorization in the action method itself.

Attack Vector

An authenticated user with only the access_setting role invokes the Livewire endpoint using a crafted request that targets the vulnerable component method. The payload references the carrier option, shipping zone, tax zone, or tax rate identifier to delete. Because the method skips server-side gate evaluation, the delete proceeds and persists the change. This network-based attack requires low privileges and no user interaction.

php

// Security patch excerpt from Shopper v2.9.2
// Source: https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff
// The upstream fix "fix(admin): enforce authorization on unguarded settings
// and bulk actions (#570)" adds server-side authorization checks to the
// delete actions in the affected Livewire components. See Pull Request #570
// for the full set of enforcement changes.

Source: GitHub Pull Request #570

Detection Methods for CVE-2026-56826

Indicators of Compromise

Unexpected deletions of records in the shipping_zones, tax_zones, tax_rates, or carrier option tables.
Livewire POST requests to Settings Zones or Taxes components originating from accounts holding only the access_setting permission.
Checkout failures or missing shipping and tax options reported by customers after admin activity.

Detection Strategies

Enable Laravel audit logging on delete operations within Settings components and alert on actions by non-administrator roles.
Correlate web server logs for Livewire endpoint invocations targeting ZoneShippingOptions, Zones/Detail, Taxes/Detail, or TaxRates.
Review database change logs for destructive events on shipping and tax tables outside scheduled maintenance windows.

Monitoring Recommendations

Monitor administrative session activity for low-privilege accounts accessing Settings pages.
Track changes to Shopper package versions in deployment pipelines to confirm upgrade to 2.9.2 or later.
Alert on configuration drift in shipping, carrier, and tax reference data.

How to Mitigate CVE-2026-56826

Immediate Actions Required

Upgrade Shopper to version 2.9.2 or later using the Shopper Release v2.9.2 notes.
Audit all accounts holding the access_setting permission and revoke access from users who do not require Settings administration.
Restore deleted shipping zones, tax zones, tax rates, and carrier options from backups if destructive activity is confirmed.

Patch Information

The fix is delivered in Shopper 2.9.2 via commit bf72e2753e21296184596d507336c7d65ecd46ff and GitHub Pull Request #570. The patch enforces server-side authorization on unguarded Settings and bulk actions. Full advisory details are available in GitHub Security Advisory GHSA-f7h9-qv4x-9x57.

Workarounds

Restrict the access_setting permission to trusted administrators until the upgrade is deployed.
Place a reverse proxy rule in front of the Livewire endpoint to deny Settings component calls from non-admin sessions.
Enable database-level row protection or triggers that block deletes on shipping and tax reference tables outside maintenance windows.

bash

# Upgrade Shopper via Composer
composer require shopper/framework:^2.9.2
php artisan shopper:publish --force
php artisan migrate
php artisan cache:clear