CVE-2026-62989
Deferred Deferred - Pending Action

Shopper Admin Panel Variants Component Permission Bypass

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-30
Last Modified
2026-10-30
Generated
2026-10-30
AI Q&A
2026-10-30
EPSS Evaluated
N/A
NVD
CVE-2026-62989

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shopperlabs shopper < 2.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authorization bypass vulnerability in Shopper, a Headless e-commerce Admin Panel. An authenticated staff user with edit_products permission can delete product variants without the required delete_product_variants permission. The Variants Livewire component exposes delete actions that permanently remove variants when accessed via specific paths, potentially destroying the product catalog.

Detection Guidance

Check Shopper admin panel versions below 2.10.0. Inspect network logs for unauthorized POST requests to /shopper/products/{id}/edit with callTableAction or callTableBulkAction parameters. Review staff user permissions for edit_products without delete_product_variants.

Impact Analysis

This vulnerability allows unauthorized deletion of product variants, which can destroy your sellable catalog. This disrupts storefront product pages, shopping carts, and checkout processes, potentially causing business disruption and loss of sales.

Mitigation Strategies

Upgrade Shopper to version 2.10.0 or later. Remove edit_products permission from staff users who do not have delete_product_variants. Monitor for unauthorized variant deletions and restrict access to admin panel endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62989. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart