CVE-2026-62989

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with editproducts can access...

CVE-2026-62989

Prior to version 2.10.0 , the Shopper Headless e-commerce Admin Panel is vulnerable to an authorization bypass in the Variants Livewire component located at packages/admin/src/Livewire/Components/Products/Form/Variants.php. The root cause is a lack of server-side authorization for DeleteAction an...

CVE-2026-62989: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with editproducts can access...