CVE-2026-56827
Received Received - Intake

Authorization Bypass in Shopper Admin Panel

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/Livewire/Pages/Category/Index.php, and packages/admin/src/Livewire/Pages/Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Per-record actions and the comparison pages identified by the advisory are correctly authorized and are not affected. This issue is fixed in version 2.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-56827
EUVD
EUVD-2026-78916

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shopper shopper 2.9.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authorization bypass in the Shopper e-commerce framework where browse-only staff users with read-only permissions can perform unauthorized mass-delete and mass-toggle operations on critical data. The issue affects bulk actions in admin pages for attributes, tags, brands, categories, and suppliers. The missing server-side authorization checks allow these users to delete attributes or tags and change visibility of brands, categories, or suppliers, potentially disrupting the storefront catalog.

Detection Guidance

Check for unauthorized bulk actions or deletions in Shopper admin panels. Review server logs for suspicious activity in Attribute, Tag, Brand, Category, or Supplier Livewire components. Look for users with browse-only permissions performing delete or toggle operations.

Impact Analysis

This vulnerability can allow a low-privilege user to mass delete product attributes or tags, or toggle the visibility of brands, categories, or suppliers. This could break product variants and severely disrupt the storefront catalog visibility, leading to data loss and operational disruption for the e-commerce platform.

Mitigation Strategies

Upgrade Shopper to version 2.9.2 or later. Review and restrict user permissions to ensure only authorized staff can perform bulk actions. Audit logs for any unauthorized changes made by browse-only users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56827. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart