CVE-2026-56825: 
PHP vulnerability analysis and mitigation

CVE-2026-56825 is a missing authorization vulnerability in the Shopper Headless e-commerce Admin Panel (composer package shopper/framework) that allows authenticated staff users with only browse_collections permission to detach products from any collection in the database. The flaw exists in packages/admin/src/Livewire/Components/Collection/CollectionProducts.php, where both Action::make('delete') and DeleteBulkAction::make() lack ->authorize() checks, and the public Collection $collection property is not protected with the Livewire #[Locked] attribute, making it client-mutable. It affects all versions prior to 2.9.2 and was published to the GitHub Advisory Database on September 11, 2026. The CVSS v3.1 base score is 8.1 (High) (Github Advisory).

The root cause is CWE-862 (Missing Authorization): the CollectionProducts Livewire component exposes destructive Filament actions — a per-record delete (line 73) and a bulk delete (line 91) — without any server-side permission gate (Github Advisory). Compounding this, the public Collection $collection property at line 40 lacks the #[Locked] Livewire attribute, meaning an attacker can freely substitute any collection ID in the Livewire wire payload sent to /shopper/livewire/update. Exploitation requires only a valid authenticated admin-panel session (any role including browse_collections) and knowledge of target collection and product IDs; no edit_collections or delete_collections permission is needed. A public PoC including curl commands and a Python script is available in the security advisory (Shopper Advisory).

Successful exploitation allows a low-privileged staff member to silently detach individual products or bulk-detach all products from any collection in the database, including featured promotional collections the attacker has never viewed. This breaks storefront catalog landing pages and associated promotions, causing availability and integrity impacts to the e-commerce platform. There is no confidentiality impact (no data is read or exfiltrated), but the ability to target arbitrary collection IDs means the attacker is not constrained to collections they have legitimate access to, amplifying the potential for widespread catalog disruption (Github Advisory, Shopper Advisory).

A public proof-of-concept exploit — including step-by-step curl commands and a standalone Python script — is included in the official security advisory, and has been classified as a real exploit with high confidence by Feedly threat intelligence (Shopper Advisory). The NVD SSVC assessment classifies exploitation status as "poc" and the attack is not automatable (requires a valid authenticated session). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.47–0.50%, placing it in the 41st percentile for exploitation probability within 30 days (Github Advisory).

1. Authenticate: Log in to the Shopper admin panel with any staff account holding at least the browse_collections role. Capture the laravel_session cookie and the URL-decoded XSRF-TOKEN cookie value from the login response.
2. Enumerate targets: Identify the target collection ID (e.g., 5) and the product IDs to detach (e.g., [1, 2, 3, 4, 5]). These can be obtained by browsing the admin panel or through brute-force enumeration of integer IDs.
3. Obtain Livewire component ID: Load any page containing the CollectionProducts Livewire component and extract the component snapshot ID from the page source HTML.
4. Craft malicious Livewire payload: Construct a JSON payload with the snapshot field setting data.collection to the target collection ID. Because $collection lacks #[Locked], Livewire accepts the client-supplied value without validation:

curl -s -X POST http://TARGET/shopper/livewire/update \
  -H "Content-Type: application/json" \
  -H "X-XSRF-TOKEN: $XSRF" \
  -H "Cookie: laravel_session=$SESSION" \
  -H "X-Livewire: 1" \
  -d '{"components": [{"snapshot": "{\"id\":\"COMPONENT_ID\",\"data\":{\"collection\":5},\"checksum\":\"...\"}", "updates": {}, "calls": [{"path": "", "method": "callBulkAction", "params": ["delete", [1, 2, 3, 4, 5]]}]}]}'

5. Invoke unauthorized bulk delete: The server processes the request, invokes DeleteBulkAction::make() (which has no ->authorize() check), and calls $this->collection->products()->detach(...) on the attacker-specified collection.
6. Confirm success: An HTTP 200 response is returned and the targeted products are detached from the collection, disrupting the associated storefront landing pages and promotions (Shopper Advisory).

• Network: Unexpected POST requests to /shopper/livewire/update from staff accounts with browse_collections-only roles, particularly with JSON payloads containing callBulkAction with method delete; requests where the collection value in the snapshot differs from collections the user has navigated to.
• Logs: Laravel/application logs showing collection.add.product dispatch events triggered by users without delete_collections or edit_collections permissions; access logs showing repeated Livewire update calls with varying collection IDs from the same session.
• Application State: Unexpected emptying of product collections in the database, particularly for featured or promotional collections; sudden drops in product counts associated with specific collections without corresponding admin activity in audit logs.

Upgrade to Shopper version 2.9.2 or later, which adds #[Locked] to the $collection property and chains ->authorize('delete_collections') to both Action::make('delete') and DeleteBulkAction::make() in CollectionProducts.php (Shopper Release, Fix PR). If an immediate upgrade is not possible, manually apply the patch from commit bf72e27 to add the #[Locked] attribute and ->authorize() chains to the affected component (Fix Commit). As an interim measure, restrict admin panel access to only fully trusted users and audit existing staff role assignments to minimize exposure.

The vulnerability was reported by security researcher Vishal Shukla (@shukla304 / @therawdev) via an AI-assisted research agent at sechub.dev, and was acknowledged and patched by maintainer @mckenziearts on June 22, 2026 (Shopper Advisory). The fix was part of a broader authorization hardening effort (PR #570) that addressed multiple similar missing-authorization gaps across several admin Livewire components in the same release (Fix PR).