CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-56826

The Shopper Headless e-commerce Admin Panel (versions 2.0.0 through 2.9.2 ) is vulnerable to missing function-level authorization. Four Livewire components in the Settings area—specifically ZoneShippingOptions, Zones izDetail, Taxes izDetail, and Taxes izTaxRates—perform destructive delete and ed...