CVE-2026-56829

Shopper (a headless e-commerce admin panel) prior to 2.9.2 has an authorization bypass in the Livewire VariantStock component. The stockAction() method lacks an edit_product_variants permission check, and the public $variant property is missing the #[Locked] attribute, making it client-mutable vi...

CVE-2026-56825

Shopper (a headless e-commerce admin panel) is vulnerable to an authorization bypass in the CollectionProducts Livewire component prior to v2.9.2 . Two defects combine: the per-record and bulk delete actions lack an ->authorize(...) guard, and the public $collection property is not marked #[Lo...

PT-2026-90545

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...