Junglewise Threat Intelligence

CVE-2026-56830: Shopper Media component missing authorization in store()

CVE-2026-56830 · Severity: medium · CVSS 6.5 · Published 2026-09-11

Executive brief

Shopper is a Laravel-based e-commerce product management framework. The Media component handles product image uploads and gallery management in the admin panel. Due to a missing authorization check, staff members with read-only product access can modify product images and thumbnails, allowing defacement or substitution of product photos without proper audit trails or permission validation.

Technical details

A missing $this->authorize('edit_products') call in the Media.php store() method (lines 64–76) allows privilege escalation via Livewire RPC. The vulnerable component accepts authenticated requests from staff holding browse_products permission and updates product media fields via $this->product->update($this->form->getState()) without verifying edit_products capability. Although the $product property is server-side locked (preventing arbitrary product targeting), the permission gate is entirely absent. An attacker must be an authenticated admin-panel user and must have previously loaded the target product's edit page in their session (to capture the Livewire snapshot), but the exploit itself is trivial: a single POST to /shopper/livewire/update with the stored snapshot and a call to store(). This is a regression from an incomplete prior patch (GHSA-h4mp-g9c6-xwph) that fixed five sibling sub-form components but omitted Media from the remediation list.

Affected products

  • ShopperLabs Shopper < 2.9.2

Timeline

  • 2026-06-22: disclosed: Vulnerability published by ShopperLabs on GitHub
  • 2026-09-11: advisory: GitHub Advisory Database entry created (GHSA-99h5-jhh7-v3r3)
  • 2.9.2: patched: Fix released in version 2.9.2 (adds authorize() call)

References

Related threats