CVE-2026-56825High· 8.1▾ MidnightPoC availableShopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 44.6 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
Exploit / PoC code exists
0.5%
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
shopper/framework < 2.9.2Patched in:
shopper/framework 2.9.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56827High· 8.1Shopper is a Headless e-commerce Admin Panel
CVE-2026-56829High· 8.1Shopper is a Headless e-commerce Admin Panel
CVE-2026-56830Medium· 6.5Shopper is a Headless e-commerce Admin Panel
CVE-2026-56831Medium· 6.5Shopper is a Headless e-commerce Admin Panel
CVE-2026-16772High· 8.1In Akaunting versions <= 3.1.21, low‑privileged authenticated users can modify their own account to assign themselves the admin role ID, granting full administrator privileges
CVE-2025-70141Critical· 9.4SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php