CVE-2026-56831 Overview
CVE-2026-56831 affects Shopper, a headless e-commerce admin panel built on Laravel. The /cpanel/discounts administrative interface accepts negative fixed_amount discount values and persists them in the sh_discounts table. The application then passes these values through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the cart pipeline subtracts discountTotal from the subtotal, a negative discount inflates the order total instead of reducing it. The issue is classified under [CWE-20: Improper Input Validation] and is fixed in version 2.9.0.
Critical Impact
An authenticated administrator can store malformed discount records that corrupt order pricing and break financial data integrity across the storefront.
Affected Products
- Shopper (shopperlabs/shopper) headless e-commerce admin panel prior to 2.9.0
- vendor/shopper/cart discount calculation pipeline
- sh_discounts persistence layer exposed via /cpanel/discounts
Discovery Timeline
- 2026-09-15 - CVE-2026-56831 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-56831
Vulnerability Analysis
The vulnerability originates in the discount creation workflow inside the Shopper admin panel. The DiscountForm Livewire component exposed a numeric input for fixed_amount discounts without a minimum-value constraint. Records written to sh_discounts therefore accepted negative integers after currency conversion. Downstream, DiscountCalculator and the Calculate pipeline treat the stored value as an authoritative discountTotal and subtract it from the cart subtotal. A negative subtraction inverts the arithmetic and increases the payable total, producing inconsistent invoices, incorrect ledger entries, and broken reconciliation against payment processors. The advisory does not establish a customer-facing exploitation path, so impact is scoped to integrity of stored pricing data rather than direct consumer fraud.
Root Cause
The root cause is missing input validation on the discount value field in packages/admin/src/Livewire/SlideOvers/DiscountForm.php. No minValue or maxValue constraint was enforced, and no equivalent guard existed in the cart calculation pipeline. Trust in administrator-supplied input replaced a domain invariant that discount magnitudes must be strictly positive.
Attack Vector
Exploitation requires an authenticated user with access to the /cpanel/discounts route. The attacker submits a discount record with a negative fixed_amount (for example, -5000 cents). The record persists and applies to any cart that satisfies its activation conditions, silently increasing totals across affected orders.
// Security patch in packages/admin/src/Livewire/SlideOvers/DiscountForm.php
// fix(discounts): enforce positive discount values across all layers (#528)
return is_no_division_currency($currency) ? (int) $state : (int) round((float) $state * 100);
})
->numeric()
+ ->minValue(fn (Get $get): float => $get('type') === DiscountType::Percentage->value ? 1 : 0.01)
+ ->maxValue(
+ fn (Get $get): ?int => $get('type') === DiscountType::Percentage->value ? 100 : null
+ )
->required(),
]),
Toggle::make('is_active')
Source: GitHub Commit 967e616
Detection Methods for CVE-2026-56831
Indicators of Compromise
- Rows in the sh_discounts table where the value column is less than or equal to zero for fixed_amount type entries.
- Order records whose discount_total column is negative, or whose final total exceeds subtotal plus tax and shipping.
- Administrative audit log entries showing discount creation or update events immediately followed by pricing anomalies on new orders.
Detection Strategies
- Run a scheduled SQL check against sh_discounts for value <= 0 and alert on any matching rows.
- Compare invoice totals against expected arithmetic (subtotal - discount + tax + shipping) and flag deviations.
- Review Laravel application logs and web server access logs for POST or PATCH requests to /cpanel/discounts originating from unexpected admin accounts or IP ranges.
Monitoring Recommendations
- Enable database change auditing on the sh_discounts table to capture insert and update operations with actor identity.
- Forward Shopper admin panel authentication events to a centralized logging platform and alert on privilege escalation or unusual admin logins.
- Baseline discount-to-order-value ratios and alert on statistical outliers that could indicate malformed discount records in production.
How to Mitigate CVE-2026-56831
Immediate Actions Required
- Upgrade Shopper to version 2.9.0 or later using composer update shopper/framework.
- Audit all existing sh_discounts rows and remove or correct entries with non-positive value fields.
- Rotate credentials for any administrator account that may have been compromised and review recent discount-related changes.
Patch Information
The fix is delivered in Shopper release v2.9.0 via Pull Request #528 and commit 967e616. The patch enforces a minValue of 0.01 for fixed-amount discounts, caps percentage discounts at 100, and adds validation messages including invalid_value and invalid_percentage. Full details are documented in GitHub Security Advisory GHSA-5vf4-452p-jjhf.
Workarounds
- Restrict access to /cpanel/discounts to a minimal set of trusted administrators until the upgrade is applied.
- Add a database-level CHECK constraint on sh_discounts.value to reject non-positive values.
- Backport the minValue and maxValue constraints from PR #528 into DiscountForm.php if immediate upgrade is not feasible.
# Configuration example: upgrade and verify
composer require shopper/framework:^2.9.0
php artisan migrate
# Database integrity check
mysql -e "SELECT id, name, type, value FROM sh_discounts WHERE value <= 0;"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
