CVE-2026-56826: Shopper Framework missing authorization in Settings components

CVE-2026-56826 · Severity: medium · CVSS 5.4 · Published 2026-10-13

Four admin interface components in Shopper (a PHP e-commerce platform) fail to validate user permissions before allowing deletion of critical checkout configuration—shipping zones, tax rates, carrier options, and tax zones. A low-privileged staff member holding only basic settings access can delete these records, breaking the storefront's shipping calculations, tax resolution, and payment method availability for customers.

Technologies: shopper/framework (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-56826 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-56826 being exploited in the wild.
How severe is CVE-2026-56826?
Medium severity, with a CVSS score of 5.4, published 13 October 2026.
Which products and versions are affected?
shopper/framework (Packagist) >= 2.0.0, < 2.9.2, ECOSYSTEM:introduced=2.0.0,fixed=2.9.2.
Is there a fix for CVE-2026-56826?
Yes. shopper/framework (Packagist): upgrade to 2.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56826 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-56826?
Check whether you run shopper/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • shopper/framework (Packagist): upgrade to 2.9.2 or later
    composer require shopper/framework:^2.9.2

Technical details

The vulnerability lies in four Livewire/Filament components (`Settings\Zones\ZoneShippingOptions`, `Settings\Zones\Detail`, `Settings\Taxes\Detail`, `Settings\Taxes\TaxRates`) that define destructive `delete` and `edit` actions without calling `->authorize()` or applying authorization guards. The parent page only checks a coarse `access_setting` permission, and child components re-execute HTTP handler code at the `/livewire/update` endpoint without re-checking permissions. The most direct case is `ZoneShippingOptions::deleteAction()`, which deletes a `CarrierOption` by a client-supplied ID with no permission check or scoping. Attack surface is the Livewire component update endpoint, reachable over the network by any authenticated user. Impact includes deletion of shipping rates, zones, tax configuration, and payment method mappings, rendering the checkout flow non-functional. Version 2.9.2 is patched; versions ≥2.0.0 and <2.9.2 are vulnerable.

Affected products

  • Shopper Labs Shopper Framework >= 2.0.0, < 2.9.2

Identifiers

  • CVE-2026-56826
  • GHSA-f7h9-qv4x-9x57

Timeline

  • 2026-06-22: disclosed
  • 2026-09-11: advisory: Published to GitHub Advisory Database
  • 2026-09-11: patched: Version 2.9.2 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.