# CVE-2026-56826: Shopper Framework missing authorization in Settings components

Source: https://junglewise.ai/threats/cve-2026-56826-shopper-framework-missing-authorization-in-settings-components  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56826 · Severity: medium · CVSS 5.4 · Published 2026-10-13

Four admin interface components in Shopper (a PHP e-commerce platform) fail to validate user permissions before allowing deletion of critical checkout configuration—shipping zones, tax rates, carrier options, and tax zones. A low-privileged staff member holding only basic settings access can delete these records, breaking the storefront's shipping calculations, tax resolution, and payment method availability for customers.

Technologies: [shopper/framework (Packagist)](https://junglewise.ai/threats/technologies/shopper-framework). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-56826 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56826 being exploited in the wild.

**How severe is CVE-2026-56826?** Medium severity, with a CVSS score of 5.4, published 13 October 2026.

**Which products and versions are affected?** shopper/framework (Packagist) >= 2.0.0, < 2.9.2, ECOSYSTEM:introduced=2.0.0,fixed=2.9.2.

**Is there a fix for CVE-2026-56826?** Yes. shopper/framework (Packagist): upgrade to 2.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56826 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-56826?** Check whether you run shopper/framework (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shopper/framework (Packagist): upgrade to 2.9.2 or later

  ```sh
  composer require shopper/framework:^2.9.2
  ```


## Technical details

The vulnerability lies in four Livewire/Filament components (`Settings\Zones\ZoneShippingOptions`, `Settings\Zones\Detail`, `Settings\Taxes\Detail`, `Settings\Taxes\TaxRates`) that define destructive `delete` and `edit` actions without calling `->authorize()` or applying authorization guards. The parent page only checks a coarse `access_setting` permission, and child components re-execute HTTP handler code at the `/livewire/update` endpoint without re-checking permissions. The most direct case is `ZoneShippingOptions::deleteAction()`, which deletes a `CarrierOption` by a client-supplied ID with no permission check or scoping. Attack surface is the Livewire component update endpoint, reachable over the network by any authenticated user. Impact includes deletion of shipping rates, zones, tax configuration, and payment method mappings, rendering the checkout flow non-functional. Version 2.9.2 is patched; versions ≥2.0.0 and <2.9.2 are vulnerable.

## Affected products

- Shopper Labs Shopper Framework >= 2.0.0, < 2.9.2

## Identifiers

- CVE-2026-56826
- GHSA-f7h9-qv4x-9x57

## Timeline

- 2026-06-22: disclosed
- 2026-09-11: advisory: Published to GitHub Advisory Database
- 2026-09-11: patched: Version 2.9.2 released

## References

- [https://api.github.com/users/baradika](https://api.github.com/users/baradika)
- [https://github.com/baradika](https://github.com/baradika)
- [https://api.github.com/users/baradika/gists%7B/gist_id%7D](https://api.github.com/users/baradika/gists%7B/gist_id%7D)
- [https://api.github.com/users/baradika/repos](https://api.github.com/users/baradika/repos)
- [https://avatars.githubusercontent.com/u/137510281?v=4](https://avatars.githubusercontent.com/u/137510281?v=4)
- [https://api.github.com/users/baradika/events%7B/privacy%7D](https://api.github.com/users/baradika/events%7B/privacy%7D)

## Related threats

- [Shopper privilege escalation via improper Livewire authorization](https://junglewise.ai/threats/cve-2026-56828-shopper-privilege-escalation-via-improper-livewire-authorization)
- [Shopper Framework negative discount validation bypass](https://junglewise.ai/threats/cve-2026-56831-shopper-framework-negative-discount-validation-bypass)
- [Shopper Media component missing authorization in store()](https://junglewise.ai/threats/cve-2026-56830-shopper-media-component-missing-authorization-in-store)
- [Shopper VariantStock missing authorization and unlocked property](https://junglewise.ai/threats/cve-2026-56829-shopper-variantstock-missing-authorization-and-unlocked-property)
- [Shopper authorization bypass in Filament bulk actions](https://junglewise.ai/threats/cve-2026-56827-shopper-authorization-bypass-in-filament-bulk-actions)