CVE-2026-56829: 
PHP vulnerability analysis and mitigation

CVE-2026-56829 is a missing authorization vulnerability in the VariantStock Livewire component of the shopper/framework package (Shopper e-commerce framework for Laravel). It allows any authenticated admin-panel user — including browse-only staff with zero edit permissions — to manipulate inventory stock levels for any product variant in the database. The vulnerability was originally reported by Vishal Shukla (@therawdev) and first published on June 22, 2026, with the advisory added to the GitHub Advisory Database on September 11, 2026. All versions of shopper/framework prior to 2.9.2 are affected. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Shopper Advisory).

The root cause is CWE-862 (Missing Authorization) combined with an unlocked Livewire model binding. In packages/admin/src/Livewire/Components/Products/VariantStock.php (lines 34–91), the public $variant property lacks the #[Locked] attribute, meaning the variant ID is fully client-mutable via the Livewire wire payload — an attacker can substitute any integer variant ID in the JSON snapshot sent to /shopper/livewire/update. The stockAction() method returns a Filament Action with no ->authorize(...) chain, so no permission gate is evaluated before the stock mutation (mutateStock() or decreaseStock()) is executed. An attacker needs only a valid admin-panel session (any role, including browse-only) and a Livewire component snapshot ID obtainable from the page source (GitHub Advisory, Shopper Advisory).

Successful exploitation allows any authenticated admin-panel user to set the inventory quantity of any product variant to an arbitrary value, regardless of their assigned role or permissions. An attacker could zero out stock for every variant store-wide (triggering out-of-stock states and disrupting sales), or inflate stock counts to bypass stock-gating controls at checkout, enabling fraudulent purchases of otherwise unavailable items. Because the $variant property is unlocked, the attacker is not limited to variants visible on their current page and can target any variant by its integer ID, affecting the entire product catalog (GitHub Advisory).

No public proof-of-concept exploit code has been released beyond the detailed reproduction steps and Python PoC script included in the security advisory itself. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability requires only a low-privilege authenticated session (any admin-panel account), making it accessible to a broad range of internal users. No EPSS score or CISA KEV catalog entry has been identified for this CVE (GitHub Advisory, Feedly).

1. Obtain credentials: Acquire any admin-panel account, including a browse-only role such as browse_products or browse_orders. No edit_product_variants permission is required.
2. Authenticate and capture tokens: Log in to the Shopper admin panel via a browser. Capture the laravel_session cookie and the XSRF-TOKEN cookie from the authenticated session.
3. Retrieve Livewire component ID: Navigate to any product variant page in the admin panel. Inspect the page source or network traffic to extract the Livewire component snapshot ID (VARIANT_STOCK_COMPONENT_ID) for the VariantStock component.
4. Craft malicious Livewire payload: Construct a JSON payload targeting the /shopper/livewire/update endpoint. Set component.data.variant to the integer ID of any target variant in the database (not limited to variants on the current page).
5. Send the request: POST the crafted payload with the session cookie and XSRF token:

curl -s -X POST http://TARGET/shopper/livewire/update \
  -H "Content-Type: application/json" \
  -H "X-XSRF-TOKEN: <TOKEN>" \
  -H "Cookie: laravel_session=<SESSION>" \
  -d '{"components": [{"snapshot": "{\"id\":\"COMPONENT_ID\",\"data\":{\"variant\":42},\"checksum\":\"...\"}", "updates": {}, "calls": [{"path":"","method":"callAction","params":["stock",{"inventory":1,"quantity":999}]}]}]}'

6. Achieve unauthorized stock mutation: The server responds with HTTP 200 and the target variant's stock is adjusted by the specified quantity, with no permission check performed (GitHub Advisory, Shopper Advisory).

• Network: Unexpected POST requests to /shopper/livewire/update from admin-panel users with browse-only roles; requests containing callAction with method stock and variant IDs not associated with the user's current page session.
• Logs: Laravel/application logs showing stockAction or mutateStock/decreaseStock calls from user accounts lacking edit_product_variants permissions; repeated Livewire update requests with varying variant integer IDs in rapid succession.
• Application Data: Sudden unexplained changes to product variant inventory levels (zeroed-out stock across multiple variants, or abnormally inflated quantities); inventory audit logs showing stock mutations attributed to browse-only staff accounts.
• Session/Auth: Admin-panel sessions from low-privilege accounts accessing the VariantStock Livewire component endpoint outside of normal browsing patterns (GitHub Advisory).

Upgrade shopper/framework to version 2.9.2 or later, which is the patched release addressing this vulnerability. If immediate upgrade is not possible, apply the following code-level mitigations manually in packages/admin/src/Livewire/Components/Products/VariantStock.php: add the #[Locked] attribute to the $variant property to prevent client-side ID substitution, and add ->authorize('edit_product_variants') to the stockAction() Action chain. Additionally, audit all other Livewire components in the admin package for similar missing #[Locked] attributes and absent authorization checks (GitHub Advisory, Shopper Advisory).

The vulnerability was reported by Vishal Shukla (@therawdev / @shukla304) as part of an AI-assisted security research effort via sechub.dev, which conducts automated audits of open-source projects. The advisory notes that the audit was AI-assisted and that sponsorship funds model API costs for continued OSS security research. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (Shopper Advisory).