CVE-2026-114387

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

CVE-2026-114387 Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

EUVD-2026-107234

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only accessdashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

CVE-2026-114387

Shopper versions 2.0.0 before 2.6.0 are vulnerable to a privilege escalation flaw due to missing authorization in Livewire components. Users with only access_dashboard privileges can bypass intended restrictions by directly calling CreateTeamMember::store() or Permissions::togglePermission() via ...

PT-2026-120574

Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store or Permissions::togglePermission directly over /livewire/update to...

CVE-2026-56826

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-56826

The Shopper Headless e-commerce Admin Panel (versions 2.0.0 through 2.9.2 ) is vulnerable to missing function-level authorization. Four Livewire components in the Settings area—specifically ZoneShippingOptions, Zones izDetail, Taxes izDetail, and Taxes izTaxRates—perform destructive delete and ed...

CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-108691

mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to...

CVE-2026-56830

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56831

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixedamount discount values, persists them in shdiscounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and...

CVE-2026-56825

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make'delete' and DeleteBulkAction::make without deletecollections authorization, while public Collection $collection remains client mutable becaus...

CVE-2026-56827

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and...

CVE-2026-56829

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction without editproductvariants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

EUVD-2026-78920

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830 Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

CVE-2026-56830

Shopper (Headless e-commerce Admin Panel) is affected by a missing authorization check in the Media sub-form (packages/admin/src/Livewire/Components/Products/Form/Media.php). The store() method lacked the authorize('edit_products') call that was added to five sibling sub-forms (Edit, Inventory, S...