Executive brief
Shopper is an e-commerce administration panel. A security flaw in the product management interface allowed any logged-in user, regardless of their assigned permissions, to modify product details such as pricing, stock levels, and shipping information. This could lead to unauthorized price changes or inventory manipulation by low-privileged staff or compromised accounts.
Technical details
A missing authorization vulnerability (CWE-862) exists in Shopper's Livewire sub-form components (Edit, Inventory, Seo, Shipping, Files). The 'store()' method in these components failed to verify if the authenticated user possessed the 'edit_products' permission. Additionally, the product ID was exposed as a public Livewire property without the '#[Locked]' attribute, allowing attackers to manipulate the wire payload to target arbitrary products. An authenticated attacker with network access to the panel can mutate product pricing, stock, SEO metadata, and media. The issue is resolved in version 2.8.0 by implementing proper authorization checks and locking product bindings.
Affected products
- Shopper Labs shopper/framework < 2.8.0
Timeline
- 2026-05-20: disclosed: Initial disclosure by reporter
- 2026-05-29: advisory: NVD publication date
- 2026-06-05: advisory: GitHub Advisory reviewed and published