CVE-2026-56825: 
PHP vulnerability analysis and mitigation

CVE-2026-56825 is a missing authorization vulnerability in the CollectionProducts Livewire component of the Shopper e-commerce framework (shopper/framework) for Laravel. It allows any authenticated admin-panel user — including those with only browse_collections permissions — to detach individual or all products from any collection in the database. The vulnerability affects all versions of shopper/framework prior to 2.9.2, and was first reported by Vishal Shukla (@therawdev) and published by the maintainer on June 22, 2026, with the advisory added to the GitHub Advisory Database on September 11, 2026. It carries a CVSS v3.1 base score of 8.1 (High) (Github Advisory, Shopper Advisory).

The root cause is CWE-862 (Missing Authorization): neither the per-record Action::make('delete') at line 73 nor the DeleteBulkAction::make() at line 91 in packages/admin/src/Livewire/Components/Collection/CollectionProducts.php includes an ->authorize(...) chain to enforce permission checks. Compounding the issue, the public Collection $collection property at line 40 is not decorated with the #[Locked] Livewire attribute, meaning the collection ID is fully mutable in the Livewire wire payload sent by the client. An attacker can craft a POST request to /shopper/livewire/update with an arbitrary collection ID in the component snapshot and invoke callBulkAction with a list of product IDs, bypassing all authorization checks. A public proof-of-concept Python script and curl command are included in the advisory (Github Advisory, Shopper Advisory).

A low-privileged authenticated staff member (e.g., holding only browse_collections) can silently empty any product collection in the database — including featured promotional collections they have never accessed — by manipulating the Livewire wire payload. This breaks storefront catalog groupings, associated landing pages, and active promotions, resulting in high integrity and availability impact. There is no confidentiality impact, as the vulnerability only enables destructive data modification, not data disclosure (Github Advisory).

A public proof-of-concept exploit (both a curl command and a Python script) is included in the official security advisory, making exploitation straightforward for any authenticated admin-panel user. The CVE status is listed as "Reserved" and no in-the-wild exploitation has been reported. No EPSS score or CISA KEV catalog entry is currently available for this CVE (Github Advisory, Shopper Advisory).

1. Obtain a valid session: Log in to the Shopper admin panel with any account, including one that holds only the browse_collections role. Capture the laravel_session cookie and XSRF-TOKEN cookie values.
2. Identify the target collection: Browse the admin panel or enumerate collection IDs (e.g., by navigating to collection pages) to find the integer ID of the target collection (e.g., collection_id=5).
3. Obtain the Livewire component ID: View the page source of a collection products page to extract the CollectionProducts Livewire component snapshot ID (COLLECTION_PRODUCTS_COMPONENT_ID).
4. Craft the malicious Livewire request: Send a POST request to /shopper/livewire/update with the collection ID set to the target collection and invoke callBulkAction with the desired product IDs to detach:

curl -s -X POST http://TARGET/shopper/livewire/update \
  -H "Content-Type: application/json" \
  -H "X-XSRF-TOKEN: $XSRF" \
  -H "Cookie: laravel_session=$SESSION" \
  -H "X-Livewire: 1" \
  -d '{"components": [{"snapshot": "{\"id\":\"COMPONENT_ID\",\"data\":{\"collection\":5},\"checksum\":\"...\"}", "updates": {}, "calls": [{"path": "", "method": "callBulkAction", "params": ["delete", [1, 2, 3, 4, 5]]}]}]}'

5. Confirm impact: An HTTP 200 response confirms that the specified products have been detached from the target collection, regardless of the caller's actual permissions (Github Advisory, Shopper Advisory).

• Network: Unexpected POST requests to /shopper/livewire/update with X-Livewire: 1 header, particularly from accounts with limited roles (e.g., browse_collections); requests containing callBulkAction with delete method in the JSON body targeting collection IDs the user did not navigate to.
• Logs: Laravel/application logs showing bulk product detach operations (collection.products().detach(...)) initiated by low-privileged staff accounts; repeated Livewire update requests from the same session in a short time window.
• Application State: Collections found to be unexpectedly empty or missing products; storefront catalog pages returning empty results for previously populated collections; promotional landing pages broken due to missing product associations.

Upgrade shopper/framework to version 2.9.2 or later, which is the patched release addressing this vulnerability. If an immediate upgrade is not possible, the suggested fix is to add #[Locked] to the public Collection $collection property and add ->authorize('edit_collections') to both the per-record Action::make('delete') and the DeleteBulkAction::make() in CollectionProducts.php. Additionally, restrict admin-panel access to the minimum necessary roles and monitor Livewire update endpoints for anomalous bulk action calls (Github Advisory, Shopper Advisory).

The vulnerability was discovered and reported by security researcher Vishal Shukla (@shukla304 / @therawdev) as part of an AI-assisted security audit conducted via sechub.dev, with the researcher noting that running such audits on open-source projects is free for maintainers. The advisory was published by the Shopper maintainer (mckenziearts) on June 22, 2026, and added to the GitHub Advisory Database on September 11, 2026. No broader media coverage or significant community discussion has been identified beyond the official advisory (Shopper Advisory).