CVE-2026-56830

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56829

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56825

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make'delete' and DeleteBulkAction::make without deletecollections authorization, while public Collection $collection remains client mutable becaus...

CVE-2026-56830

Shopper (Headless e-commerce Admin Panel) is affected by a missing authorization check in the Media sub-form (packages/admin/src/Livewire/Components/Products/Form/Media.php). The store() method lacked the authorize('edit_products') call that was added to five sibling sub-forms (Edit, Inventory, S...

EUVD-2026-78920

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

EUVD-2026-78914

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56829

Shopper (a headless e-commerce admin panel) prior to 2.9.2 has an authorization bypass in the Livewire VariantStock component. The stockAction() method lacks an edit_product_variants permission check, and the public $variant property is missing the #[Locked] attribute, making it client-mutable vi...

CVE-2026-56825 Shopper: Missing authorization on product removal actions in CollectionProducts component

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make'delete' and DeleteBulkAction::make without deletecollections authorization, while public Collection $collection remains client mutable becaus...

Shopper: Missing authorization on product removal actions in CollectionProducts component

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

GHSA-99H5-JHH7-V3R3 Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

GHSA-G3F9-G5VJ-P62F Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant...

Shopper: privilege escalation via improper Livewire admin component authorization

Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...

GHSA-J328-XMGP-J4Q3 Shopper: privilege escalation via improper Livewire admin component authorization

Summary Three Livewire admin components in shopper/framework latest master at commit fcd0c59, released as v2.8.0 gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR 511 / GHSA-f946-9qp6-vgch — the PR moved most write...

Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

PT-2026-90546

Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph adde...

CVE-2026-86746 Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay

Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route level, not within component lifecycle methods. Attackers with a valid authenticated session can replay signed component snapshots via POST /livewire/update to...

EUVD-2026-41994

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the database import Livewire component app/Livewire/Project/Database/Import.php allows client-controlled container and server properties to reach shell commands without...