CVE-2026-56829
Received Received - Intake

Stock Manipulation in Shopper Admin Panel

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-56829
EUVD
EUVD-2026-78914

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shopper headless_e-commerce_admin_panel to 2.9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Shopper e-commerce Admin Panel allows authenticated admin users, including those with limited browse-only permissions, to modify product variant stock levels without proper authorization. The flaw exists because the stockAction() function lacks both edit_product_variants authorization and a Livewire Locked attribute, making it publicly mutable.

Detection Guidance

Check Shopper admin panel version for versions prior to 2.9.2. Review Livewire component VariantStock.php for missing authorization checks and public mutable $variant. Inspect admin panel logs for unauthorized stock adjustments by low-privilege users.

Impact Analysis

An attacker with admin access could inflate or reduce product stock levels, causing inventory discrepancies. They could force products into out-of-stock states or artificially increase availability, potentially leading to overselling, customer dissatisfaction, or financial losses.

Mitigation Strategies

Upgrade Shopper admin panel to version 2.9.2 or later. Ensure all admin users have only necessary permissions. Review and restrict variant stock modification capabilities for non-privileged users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56829. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart