# CVE-2026-56827: Shopper authorization bypass in Filament bulk actions

Source: https://junglewise.ai/threats/cve-2026-56827-shopper-authorization-bypass-in-filament-bulk-actions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56827 · Severity: high · CVSS 8.1 · Published 2026-09-15

Shopper is an open-source e-commerce admin framework built on Laravel and Filament. Staff users with read-only permissions ("browse_*") can bypass authorization checks to delete product attributes, tags, and brands/categories/suppliers in bulk, or toggle their visibility on the storefront. An attacker with low-privilege staff access could sabotage the entire product catalog or delete critical product data.

Technologies: [shopper/framework (Packagist)](https://junglewise.ai/threats/technologies/shopper-framework), [Shopper Labs Shopper](https://junglewise.ai/threats/technologies/shopper). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Shopper Labs](https://junglewise.ai/threats/vendors/shopper-labs).

## Quick answers

**Is CVE-2026-56827 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56827 being exploited in the wild.

**How severe is CVE-2026-56827?** High severity, with a CVSS score of 8.1, published 15 September 2026.

**Which products and versions are affected?** shopper/framework (Packagist) < 2.9.2, ECOSYSTEM:introduced=0,fixed=2.9.2; Shopper Labs Shopper < 2.9.2.

**Is there a fix for CVE-2026-56827?** Yes. shopper/framework (Packagist): upgrade to 2.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56827 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-56827?** Check whether you run shopper/framework (Packagist) or Shopper Labs Shopper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- shopper/framework (Packagist): upgrade to 2.9.2 or later

  ```sh
  composer require shopper/framework:^2.9.2
  ```


## Technical details

The vulnerability lies in five Livewire pages (Attribute/Browse.php, Tag/Index.php, Brand/Index.php, Category/Index.php, and Supplier/Index.php) that define groupedBulkActions for deleting or toggling visibility of catalog entities. Each page's mount() method gates access using only read-only browse_* permissions, but the bulk actions themselves lack the ->authorize(...) chain that correctly guards their per-record counterparts. An authenticated staff user with only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers permission can invoke the Livewire callTableBulkAction endpoint to delete all attributes/tags or toggle visibility on all brands/categories/suppliers. The attack requires network access and low-privilege staff authentication; no user interaction is needed once the payload is crafted. Patches are available in version 2.9.2.

## Affected products

- Shopper Labs Shopper < 2.9.2

## Identifiers

- CVE-2026-56827
- GHSA-243p-f3cv-c5wh

## Timeline

- 2026-06-22: disclosed: Initial GitHub Security Advisory (GHSA-243p-f3cv-c5wh) published
- 2026-09-11: advisory: Advisory updated and cross-referenced with CVE-2026-56827
- 2026-06-22: patched: Fix available in Shopper 2.9.2

## References

- [https://api.github.com/users/therawdev](https://api.github.com/users/therawdev)
- [https://github.com/therawdev](https://github.com/therawdev)
- [https://api.github.com/users/therawdev/gists%7B/gist_id%7D](https://api.github.com/users/therawdev/gists%7B/gist_id%7D)
- [https://api.github.com/users/therawdev/repos](https://api.github.com/users/therawdev/repos)
- [https://avatars.githubusercontent.com/u/74800891?v=4](https://avatars.githubusercontent.com/u/74800891?v=4)
- [https://api.github.com/users/therawdev/events%7B/privacy%7D](https://api.github.com/users/therawdev/events%7B/privacy%7D)

## Related threats

- [Shopper authorization bypass in customer detail route](https://junglewise.ai/threats/cve-2026-62991-shopper-is-a-headless-e-commerce-admin-panel-prior-to-2-10-1-the)
- [Shopper authorization bypass in variant deletion](https://junglewise.ai/threats/cve-2026-62989-shopper-is-a-headless-e-commerce-admin-panel-prior-to-2-10-0-the)
- [Shopper privilege escalation via improper Livewire authorization](https://junglewise.ai/threats/cve-2026-56828-shopper-privilege-escalation-via-improper-livewire-authorization)
- [Shopper privilege escalation via missing authorization in admin panel](https://junglewise.ai/threats/cve-2026-114387-shopper-from-2-0-0-before-2-6-0-contains-a-missing-authorization)
- [Shopper Framework missing authorization in Settings components](https://junglewise.ai/threats/cve-2026-56826-shopper-framework-missing-authorization-in-settings-components)