CVE-2026-56829

Shopper, a Headless e-commerce Admin Panel prior to 2.8.0, contains two authorization defects in team settings. These allow any authenticated user to take over the RBAC system, create new roles, delete other users (including administrators), and escalate privileges to full panel administrator.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through DiscountCalculator.php and Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it.

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission.

In Shopper before 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, Tag/Index.php, Brand/Index.php, Category/Index.php, and Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Fixed in version 2.9.2.

In Shopper before 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. Fixed in version 2.9.2.

In the Shopper admin panel (headless e-commerce) prior to version 2.8.0, three related defects were found: missing Locked attribute on Eloquent model identifiers in Livewire components allowed data tampering, plaintext password transmission via a hidden form field led to sensitive data disclosure, and the product barcode field was rendered without proper escaping, enabling persistent XSS.

Shopper before version 2.8.0 does not check permissions for enable/disable, edit, and delete actions in admin tables for PaymentMethods, Currencies, and Carriers. A low-privilege user can disable payment methods, change the default currency, or disable carriers.

Shopper before version 2.8.0 has a vulnerability in Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files), where the store() method lacks authorization. Any authenticated user can modify prices, stock, SEO metadata, shipping dimensions, and attachments of any product.

In Shopper, a headless e-commerce admin panel prior to version 2.8.0, the CreateOrderFromCartAction::execute function created the order before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied while the counter blocked at the limit. The merchant had no signal of over-redemption.

Shopper, a Headless e-commerce Admin Panel, prior to version 2.8.0 contains a vulnerability where multiple Filament actions on order details and shipment tables could be called by an authenticated low-privilege user without the required permission to mutate orders. Actions like cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission instead of the required edit_orders. capturePayment could trigger actual PSP capture (real funds movement). A user with read access could alter the lifecycle of every order and trigger real-world payment captures.