{"id":"CVE-2026-56830","title":"Shopper is a Headless e-commerce Admin Panel","summary":"Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used …","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","cwe":["CWE-862"],"vendor":"shopperlabs","product":"shopper","affected":["shopper < 2.9.2"],"patched":["shopper/framework 2.9.2"],"published":"2026-09-15","updated":"2026-09-15","sourceUpdated":"2026-09-15T20:17:21.753","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-56830","references":[{"url":"https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff","label":"security-advisories@github.com"},{"url":"https://github.com/shopperlabs/shopper/pull/570","label":"security-advisories@github.com"},{"url":"https://github.com/shopperlabs/shopper/releases/tag/v2.9.2","label":"security-advisories@github.com"},{"url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-99h5-jhh7-v3r3"}],"tags":["nvd","cve.org","ghsa","composer"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-15T18:57:33.615806Z"},"aliases":["GHSA-99h5-jhh7-v3r3"],"ecosystem":"composer","ingestedAt":"2026-09-12T00:03:49.069Z","epss":0.00389,"epssPercentile":0.30134,"slug":"CVE-2026-56830","body":"## Overview\n\nShopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-56830)\n\nAffected packages:\n\n- `shopper/framework < 2.9.2`\n\nPatched in:\n\n- `shopper/framework 2.9.2`\n\nSource: https://github.com/advisories/GHSA-99h5-jhh7-v3r3","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}