CVE-2026-56826: 
PHP vulnerability analysis and mitigation

CVE-2026-56826 is a missing server-side authorization vulnerability in the shopper/framework Composer package (Shopper e-commerce framework) that allows low-privileged authenticated users to delete critical commerce configuration records. Four Livewire components in the Settings area — Settings\Zones\ZoneShippingOptions, Settings\Zones\Detail, Settings\Taxes\Detail, and Settings\Taxes\TaxRates — expose destructive Filament delete/edit actions with no authorization checks. Affected versions are >= 2.0.0, < 2.9.2; the issue is patched in version 2.9.2. It carries a CVSS v3.1 base score of 5.4 (Moderate) (GitHub Advisory, Shopper Advisory). The vulnerability was originally published on June 22, 2026, and added to the GitHub Advisory Database on September 11, 2026.

The root cause is CWE-862 (Missing Authorization): the four child Livewire components handle their own /livewire/update HTTP requests independently, but rely solely on the parent page's coarse access_setting gate without re-checking authorization for destructive actions (GitHub Advisory). The most egregious case is ZoneShippingOptions::deleteAction(), which deletes a CarrierOption record using a client-supplied id argument with no scoping or permission check whatsoever — CarrierOption::query()->find($arguments['id'])->delete(). None of the four components declare ->authorize() or an enforced ->visible() guard on their actions, and the permission seeder never generates delete_zones or delete_taxes permissions, meaning no granular gate exists to enforce. An attacker only needs a valid session with the access_setting permission to invoke any of these actions directly via the Livewire endpoint (Shopper Advisory).

A low-privileged staff member or compromised account holding only access_setting can sabotage the storefront's checkout and revenue path without any delete_* permission. Deleting a CarrierOption removes that shipping rate from checkout for the affected zone; deleting a Zone severs the country-to-carrier/payment-method/currency mapping, causing customers in those regions to lose all shipping and payment options; and deleting a TaxZone or TaxRate corrupts TaxCalculator::resolveZone(), breaking tax calculation at checkout entirely (GitHub Advisory). There is no confidentiality impact, but integrity and availability of live commerce configuration are directly affected. A secondary bug was also identified: Zones\Detail::deleteAction()->after() calls $this->reset('zone') on a #[Computed] method rather than a property, triggering a ReflectionException after deletion (Shopper Advisory).

A proof-of-concept was included in the original advisory, confirmed using the project's own Pest + Orchestra Testbench test harness against the real Livewire/Filament code path with a non-admin user holding only access_setting (Shopper Advisory). No evidence of in-the-wild exploitation or threat actor attribution is currently available, and the CVE status remains "Reserved." The EPSS score is not yet published. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only low privileges (a valid authenticated session with access_setting) and no user interaction, making it straightforward for any malicious insider or attacker with a compromised low-privilege account.

1. Obtain low-privilege access: Acquire or compromise a staff account that holds the access_setting permission but lacks admin rights and any delete_*/edit_* permissions.
2. Authenticate to the admin panel: Log in to the Shopper admin interface using the low-privilege account.
3. Navigate to a vulnerable Settings page: Access any of the affected Settings pages (e.g., Settings > Zones or Settings > Taxes) to establish a valid Livewire session context.
4. Identify target record IDs: Enumerate existing CarrierOption, Zone, TaxZone, or TaxRate record IDs by observing the rendered page or intercepting Livewire responses.
5. Invoke the destructive action directly: Send a crafted POST request to the /livewire/update endpoint targeting the vulnerable component (e.g., ZoneShippingOptions) and call the delete action with a client-supplied id argument — for example: callAction('delete', arguments: ['id' => <target_id>]).
6. Confirm deletion: Verify the record has been removed; the targeted shipping rate, zone, or tax configuration is now deleted from the storefront checkout path, disrupting commerce operations (GitHub Advisory, Shopper Advisory).

• Network: Unexpected POST requests to /livewire/update from authenticated low-privilege accounts targeting component classes Settings\Zones\ZoneShippingOptions, Settings\Zones\Detail, Settings\Taxes\Detail, or Settings\Taxes\TaxRates with callAction('delete', ...) payloads.
• Logs: Application or web server logs showing repeated Livewire update requests to Settings endpoints from accounts that do not hold admin or delete_* permissions; Laravel logs recording deletion of CarrierOption, Zone, TaxZone, or TaxRate models by non-admin users.
• Database: Sudden disappearance of records in the carrier_options, zones, tax_zones, or tax_rates tables without corresponding admin-level audit trail entries.
• Application Behavior: Checkout failures related to missing shipping rates, unresolvable tax zones (TaxCalculator::resolveZone() errors), or missing carrier/payment options for specific regions — particularly if no legitimate admin deletion was performed (GitHub Advisory).

Upgrade shopper/framework to version 2.9.2 or later, which is the patched release (GitHub Advisory). As a workaround prior to patching, restrict the access_setting permission to only fully trusted staff members to reduce the attack surface. The suggested code-level remediation is to add ->authorize('access_setting') (or a new granular delete_zones/delete_taxes permission) to the deleteAction() and editAction() methods in all four affected components, and to add a mount() authorization guard on each child component matching the pattern used in Settings/Locations/Index.php and Team/RolePermission.php (Shopper Advisory). Additionally, the secondary $this->reset('zone') bug in Zones\Detail should be fixed alongside the authorization gap.

The vulnerability was reported by researcher baradika and published by maintainer mckenziearts on June 22, 2026, with the GitHub Advisory Database entry finalized on September 11, 2026 (GitHub Advisory). No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time.