CVE-2026-56825
Received Received - Intake

Shopper Admin Panel Collection Deletion Authorization Bypass

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. This issue is fixed in version 2.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-56825
EUVD
EUVD-2026-78912

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shopper shopper 2.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Shopper, a Headless e-commerce Admin Panel, allows authenticated staff users with only browse_collections permission to delete products from any collection or empty collections entirely. The issue occurs because the CollectionProducts component lacks proper authorization checks for delete actions and the $collection property is mutable without Livewire Locked protection. Attackers can manipulate collection identifiers to target any collection, disrupting catalogs, landing pages, and promotions.

Detection Guidance

To detect this vulnerability, check if your Shopper admin panel version is below 2.9.2. Inspect Livewire components like CollectionProducts.php for missing authorization checks and unlocked $collection properties. Review server logs for unauthorized deletion actions or bulk operations by low-privilege users.

Impact Analysis

An attacker with low privileges could delete products from collections, empty entire collections, or disrupt catalog landing pages and promotions. This could lead to data loss, broken storefront functionality, and potential revenue impact. The CVSS score of 8.1 indicates high severity for integrity and availability.

Mitigation Strategies

Upgrade to Shopper version 2.9.2 or later immediately. Ensure all admin Livewire components enforce authorization checks with ->authorize() and use #[Locked] attributes on client-bound model IDs. Review and restrict permissions for users with browse_collections to prevent unauthorized deletions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56825. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart