Is CVE-2026-56829 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56829 being exploited in the wild.

How severe is CVE-2026-56829?

High severity, with a CVSS score of 8.1, published 15 September 2026.

Which products and versions are affected?

shopper/framework (Packagist) < 2.9.2, ECOSYSTEM:introduced=0,fixed=2.9.2; Shopper Labs Shopper < 2.9.2.

Is there a fix for CVE-2026-56829?

Yes. shopper/framework (Packagist): upgrade to 2.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56829 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-56829?

Check whether you run shopper/framework (Packagist) or Shopper Labs Shopper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56829: Shopper VariantStock missing authorization and unlocked property

Q: Is there a fix for CVE-2026-56829?

Yes. shopper/framework (Packagist): upgrade to 2.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56829 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-56829?

Check whether you run shopper/framework (Packagist) or Shopper Labs Shopper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56829 · Severity: high · CVSS 8.1 · Published 2026-09-15

Shopper is an e-commerce admin dashboard framework. Its VariantStock component manages product inventory levels. Due to missing authorization checks and an unprotected variant property, any staff member with admin panel access—even those with browse-only permissions—can arbitrarily adjust stock quantities for any product. An attacker could zero out inventory store-wide to cause outages or inflate stock counts to bypass purchase restrictions.

Technologies: shopper/framework (Packagist), Shopper Labs Shopper. Vendors: Packagist, Shopper Labs.

Quick answers

Is CVE-2026-56829 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56829 being exploited in the wild.
How severe is CVE-2026-56829?: High severity, with a CVSS score of 8.1, published 15 September 2026.
Which products and versions are affected?: shopper/framework (Packagist) < 2.9.2, ECOSYSTEM:introduced=0,fixed=2.9.2; Shopper Labs Shopper < 2.9.2.
Is there a fix for CVE-2026-56829?: Yes. shopper/framework (Packagist): upgrade to 2.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56829 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-56829?: Check whether you run shopper/framework (Packagist) or Shopper Labs Shopper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

shopper/framework (Packagist): upgrade to 2.9.2 or later
```
composer require shopper/framework:^2.9.2
```

Technical details

A lack of authorization control exists in the stockAction() method of packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant property without the #[Locked] attribute, allowing client-side mutation of the variant ID through Livewire's wire protocol. The stockAction() returns a Form Action with no ->authorize(...) chain, permitting any authenticated admin session (regardless of role or permissions) to invoke the action. An attacker can craft a Livewire wire payload to target any variant by ID and call the stock action to adjust inventory. The missing #[Locked] attribute means the component checksum validation does not prevent variant ID substitution. Patch version 2.9.2 addresses this by adding both the #[Locked] attribute and authorization checks via ->authorize('edit_product_variants').

Affected products

Shopper Labs Shopper < 2.9.2

Identifiers

CVE-2026-56829
GHSA-g3f9-g5vj-p62f

Timeline

2026-09-11: disclosed
2026-09-11: patched: Version 2.9.2 released with authorization and #[Locked] attribute fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.