p PatchFirst

CVE-2026-56826

CVE-2026-56826 · Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.

CVSS 5.4 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • shopper

    Versions
    • >= 2.0.0, < 2.9.2: Affected

    No fix published

  • shopper/framework Packagist

    Versions
    • v2.0.0
    • v2.0.1
    • v2.0.2
    • v2.0.3
    • v2.1.1
    • v2.1.2
    • v2.1.3
    • v2.1.4
    • v2.1.5
    • v2.1.6
    • v2.2
    • v2.2.1
    • v2.2.2
    • v2.2.3
    • v2.2.4
    • v2.2.5
    • v2.2.6
    • v2.2.7
    • v2.3
    • v2.3.1
    • v2.3.2
    • v2.3.3
    • v2.4.0
    • v2.4.1
    • v2.4.2
    • v2.4.3
    • v2.5.0
    • v2.5.1
    • v2.6.0
    • v2.6.1
    • v2.6.2
    • v2.6.3
    • v2.6.4
    • v2.7.0
    • v2.7.1
    • v2.7.2
    • v2.7.3
    • v2.8.0
    • v2.8.1
    • v2.9.0
    • v2.9.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.0.0, < 2.9.2

    Update to 2.9.2

Original sources

Check your server →