CVE-2026-56826 Details
Description
Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.
A vulnerability exists in the Shopper Headless e-commerce Admin Panel versions 2.0.0 prior to 2.9.2. It allows authenticated users with limited permissions to bypass authorization and perform destructive actions through the Livewire component for Settings. The affected components manage critical commerce data such as shipping options, tax zones, and tax rates. The vulnerability arises because these components did not properly enforce server-side authorization for delete actions, enabling low-privileged users to disrupt essential checkout processes.
The vulnerability has been patched in Shopper Admin Panel version 2.9.2. Users should update to this version to address the authorization gaps.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff | [email protected] | Source CodeVendor |
| https://github.com/shopperlabs/shopper/pull/570 | [email protected] | Source CodeVendor |
| https://github.com/shopperlabs/shopper/releases/tag/v2.9.2 | [email protected] | Release NotesVendor |
| https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Shopper | >= 2.0.0, < 2.9.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 17, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |