CVE-2026-56830
Received Received - Intake

Authenticated Staff Arbitrary Image Replacement in Shopper Admin Panel

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-56830
EUVD
EUVD-2026-78920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
shopper headless_e-commerce_admin_panel to 2.9.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Shopper e-commerce framework where the Media sub-form component lacks proper authorization checks. An incomplete fix for a previous issue left the store() method without an edit_products permission check. Authenticated users with browse_products privileges can replace product thumbnails and gallery images without proper authorization.

Detection Guidance

Check if your Shopper version is below 2.9.2. Inspect the Media.php file in packages/admin/src/Livewire/Components/Products/Form/ for the missing authorize('edit_products') call in the store() method. Review server logs for unauthorized image update attempts by users with browse_products but not edit_products permissions.

Impact Analysis

An attacker could replace product images with malicious content without leaving an edit trail. This could mislead customers, damage brand reputation, or serve harmful content through a trusted product listing. The impact is limited to products whose edit pages were loaded in the admin panel.

Mitigation Strategies

Upgrade to Shopper version 2.9.2 or later. Add $this->authorize('edit_products'); to the store() method in packages/admin/src/Livewire/Components/Products/Form/Media.php. Audit user permissions to ensure only authorized users can edit products. Monitor for unauthorized image changes in product media.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56830. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart