Shopper: Missing authorization on Product admin Livewire sub-form components
Impact
Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding edit_products.
The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client.
Patches
Fixed in v2.8.0. Each sub-form store() now authorizes against edit_products and the product binding is locked.
Upgrade via:
composer require shopper/admin:^2.8Workarounds
None. Upgrade to v2.8.0.
References
- Pull request: https://github.com/shopperlabs/shopper/pull/511
- CWE-862 Missing Authorization
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | shopper/framework | < 2.8.0 | 2.8.0 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-862- Platform
- Composer
- Package
shopper/framework- Disclosed
- 05.06.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-h4mp-g9c6-xwph - CC BY 4.0
Vulnerability history: shopper/framework
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 12
- First → latest
- 05.2026 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 6
- Medium 5
Disclosures per year
- 2026: 12
-
Shopper: Missing authorization on Product admin Livewire sub-form components this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.