{"schema":"threatline.record/2","record":{"id":"CVE-2026-56826","aliases":["GHSA-f7h9-qv4x-9x57"],"summary":"Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration","details":"Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.","categories":["Libraries & packages"],"product":"shopper","vendor":"shopperlabs","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-56826","source_modified_at":"2026-10-17T00:41:10.698Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"shopper","vendor":"shopperlabs","versions":[{"status":"affected","version":">= 2.0.0, < 2.9.2"}],"defaultStatus":null},{"source":"GitHub Advisory Database","source_url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57","source_modified_at":"2026-06-24T00:56:45Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"composer","name":"shopper/framework"},"range":">= 2.0.0, < 2.9.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f7h9-qv4x-9x57","source_modified_at":"2026-09-11T21:45:09.892125463Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"ecosystem":"Packagist","name":"shopper/framework","purl":"pkg:composer/shopper/framework"},"ranges":[{"events":[{"introduced":"2.0.0"},{"fixed":"2.9.2"}],"type":"ECOSYSTEM"}],"versions":["v2.0.0","v2.0.1","v2.0.2","v2.0.3","v2.1.1","v2.1.2","v2.1.3","v2.1.4","v2.1.5","v2.1.6","v2.2","v2.2.1","v2.2.2","v2.2.3","v2.2.4","v2.2.5","v2.2.6","v2.2.7","v2.3","v2.3.1","v2.3.2","v2.3.3","v2.4.0","v2.4.1","v2.4.2","v2.4.3","v2.5.0","v2.5.1","v2.6.0","v2.6.1","v2.6.2","v2.6.3","v2.6.4","v2.7.0","v2.7.1","v2.7.2","v2.7.3","v2.8.0","v2.8.1","v2.9.0","v2.9.1"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57","source_modified_at":"2026-06-24T00:56:45Z","fetched_at":"2026-10-23T18:55:00.935475Z","package":{"ecosystem":"composer","name":"shopper/framework"},"version":"2.9.2"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-f7h9-qv4x-9x57","source_modified_at":"2026-09-11T21:45:09.892125463Z","fetched_at":"2026-10-23T18:48:36.087640Z","package":{"ecosystem":"Packagist","name":"shopper/framework","purl":"pkg:composer/shopper/framework"},"version":"2.9.2"}],"cvss":5.4,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00278,"percentile":0.19244,"score_date":"2026-10-23"},"published_at":"2026-10-13T19:11:55.629Z","modified_at":"2026-10-17T00:41:10.698Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-56826","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-17T00:41:10.698Z"},{"source":"GitHub Advisory Database","url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57","fetched_at":"2026-10-23T18:55:00.935475Z","source_modified_at":"2026-06-24T00:56:45Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-f7h9-qv4x-9x57","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-09-11T21:45:09.892125463Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-56826","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","GitHub Advisory Database","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/pull/570","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/shopperlabs/shopper/releases/tag/v2.9.2","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-17T00:40:47.210725Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-17T00:41:10.698Z","content_hash":"8278aed5d987951d387ecc5cdd0d41d9118a1c8f645ff0c6f9652dc8efdcd518"}}