CVE-2026-56826

Deferred Deferred - Pending Action

Authenticated Settings Deletion in Shopper Admin Panel

Publication date: 2026-10-13

Last updated on: 2026-10-17

Assigner: GitHub, Inc.

Description

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-17

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-56826

EUVD

EUVD-2026-100520

Affected Vendors & Products

Vendor	Product	Version / Range
shopperlabs	shopper	>= 2.0.0, < 2.9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in the Shopper e-commerce platform allows low-privilege users with only access_setting permissions to delete critical commerce configurations like tax zones, tax rates, shipping zones, and carrier options. The issue occurs because four Livewire components in the Settings area lack proper server-side authorization checks for destructive actions, enabling unauthorized deletions via direct Livewire endpoint invocations.

Detection Guidance

Check for unauthorized deletions in Shopper admin settings by monitoring Livewire endpoint logs for actions like deleting tax zones, shipping zones, tax rates, or carrier options. Look for users with only access_setting permissions performing destructive actions.

Impact Analysis

This vulnerability can disrupt live commerce operations by breaking shipping calculations, removing payment methods for specific regions, and corrupting tax resolution during checkout. It allows attackers to delete essential configurations, leading to potential loss of revenue, operational downtime, and compromised customer experience.

Compliance Impact

This vulnerability violates least-privilege principles and could lead to unauthorized data modifications or deletions, potentially compromising data integrity and availability. Such breaches may result in non-compliance with GDPR (data protection) and HIPAA (healthcare data security), risking legal penalties and reputational damage.

Mitigation Strategies

Upgrade Shopper to version 2.9.2 or later to apply the security fixes. Review and restrict permissions for users with access_setting to ensure they cannot perform destructive actions without proper authorization.

Hi! I’m here to help you understand CVE-2026-56826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70