Executive brief
Shopper is an e-commerce admin dashboard framework. Its VariantStock component manages product inventory levels. Due to missing authorization checks and an unprotected variant property, any staff member with admin panel access—even those with browse-only permissions—can arbitrarily adjust stock quantities for any product. An attacker could zero out inventory store-wide to cause outages or inflate stock counts to bypass purchase restrictions.
Technical details
A lack of authorization control exists in the stockAction() method of packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant property without the #[Locked] attribute, allowing client-side mutation of the variant ID through Livewire's wire protocol. The stockAction() returns a Form Action with no ->authorize(...) chain, permitting any authenticated admin session (regardless of role or permissions) to invoke the action. An attacker can craft a Livewire wire payload to target any variant by ID and call the stock action to adjust inventory. The missing #[Locked] attribute means the component checksum validation does not prevent variant ID substitution. Patch version 2.9.2 addresses this by adding both the #[Locked] attribute and authorization checks via ->authorize('edit_product_variants').
Affected products
- Shopper Labs Shopper < 2.9.2
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Version 2.9.2 released with authorization and #[Locked] attribute fixes