CVE-2026-56830: 
PHP Análise e mitigação de vulnerabilidades

CVE-2026-56830 is a missing authorization vulnerability in the Shopper e-commerce framework (shopper/framework) for Laravel, specifically in the Livewire Media sub-form component. It represents an incomplete fix for a prior advisory (GHSA-h4mp-g9c6-xwph): while that fix added #[Locked] to the $product property and added authorize('edit_products') to five sibling components (Edit, Inventory, Seo, Shipping, Files), the Media component's store() method was overlooked and remains unprotected. All versions of shopper/framework before 2.9.2 are affected. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Shopper Advisory).

The root cause is CWE-862 (Missing Authorization): the store() method in packages/admin/src/Livewire/Components/Products/Form/Media.php (lines 64–76) performs a direct $this->product->update($this->form->getState()) call — overwriting the product's thumbnail and gallery images — without first calling $this->authorize('edit_products'). The prior fix (commit fcd0c59) locked the $product property server-side via #[Locked], preventing client-side product ID substitution, but the permission gate itself was never added to this component. An attacker with any authenticated admin-panel session (including a browse_products-only staff account) can directly invoke store() via a crafted POST to the Livewire update endpoint (/shopper/livewire/update) using a captured component snapshot. A public proof-of-concept Python script and curl command are included in the advisory (GitHub Advisory, Shopper Advisory).

A staff user holding only browse_products — without edit_products — can replace the thumbnail and gallery images for any product they have previously loaded in their browser session. On a public storefront, this enables content defacement: replacing legitimate product images with adversarial, misleading, or harmful content without generating an edit trail attributable to a permission-holding editor. There is no confidentiality or availability impact; the risk is confined to unauthorized integrity modification of product media assets (GitHub Advisory).

A public proof-of-concept is included in the official advisory, consisting of both a curl command and a Python script that demonstrate the bypass. No in-the-wild exploitation has been reported, and the CVE status remains Reserved. The vulnerability requires a valid authenticated admin-panel session (low privilege), making it accessible to any staff account with browse_products. No CISA KEV listing or threat actor attribution is known at this time (GitHub Advisory, Shopper Advisory).

1. Obtain a low-privilege session: Log in to the Shopper admin panel with a staff account that holds browse_products but NOT edit_products.
2. Capture the Media component snapshot: As an admin (or by browsing as the low-privilege user), navigate to a product edit page. Inspect the HTML source and locate the data-livewire-snapshot attribute for the Media Livewire component. Copy the full JSON snapshot string — it contains the locked product ID server-side.
3. Capture session tokens: Extract the laravel_session cookie value and the URL-decoded XSRF-TOKEN cookie value from the browser session of the low-privilege account.
4. Invoke store() directly: Send a crafted POST request to /shopper/livewire/update using the low-privilege session, supplying the captured snapshot and calling the store method:

curl -s -X POST http://<target>/shopper/livewire/update \
  -H "Content-Type: application/json" \
  -H "X-XSRF-TOKEN: $XSRF" \
  -H "Cookie: laravel_session=$SESSION" \
  -H "X-Livewire: 1" \
  -d '{"components": [{"snapshot": "<SNAPSHOT_JSON>", "updates": {}, "calls": [{"path":"","method":"store","params":[]}]}]}'

5. Confirm success: An HTTP 200 response confirms the product's thumbnail and gallery images have been updated without edit_products authorization (GitHub Advisory, Shopper Advisory).

• Network: Unexpected POST requests to /shopper/livewire/update from sessions associated with browse_products-only accounts, particularly with calls payloads specifying "method": "store" on the Media component.
• Logs: Web server or Laravel application logs showing POST /shopper/livewire/update with X-Livewire: 1 headers from low-privilege staff accounts; absence of corresponding edit_products permission in the session's role at the time of the request.
• Application: Unexpected changes to product thumbnail or gallery images without a corresponding audit log entry from a user holding edit_products; product media updates timestamped outside normal editing workflows.
• File System: If image replacement involves uploading new files, look for new media files in the Shopper storage/media directory created by accounts without edit permissions.

Upgrade shopper/framework to version 2.9.2 or later, which adds the missing $this->authorize('edit_products') call to the store() method in Media.php. If an immediate upgrade is not possible, manually patch the file by adding $this->authorize('edit_products'); as the first line of the store() method in packages/admin/src/Livewire/Components/Products/Form/Media.php. Additionally, review staff role assignments to ensure browse_products-only accounts are limited to trusted personnel until the patch is applied (GitHub Advisory, Shopper Advisory).

The vulnerability was discovered and reported by Vishal Shukla (@shukla304 / @therawdev), who noted it was identified via an AI-assisted security research agent at sechub.dev. The advisory was published by maintainer mckenziearts on June 22, 2026, and added to the GitHub Advisory Database on September 11, 2026. No broader media coverage or significant community discussion has been identified beyond the official advisory (Shopper Advisory).