CVE-2026-56831: 
PHP vulnerability analysis and mitigation

CVE-2026-56831 is a business logic / improper input validation vulnerability in the Shopper Framework (shopper/framework) that allows authenticated administrators to create negative fixed-amount discounts, which are accepted, persisted, and processed by the cart/order calculation pipeline without any server-side validation. The vulnerability was originally published on June 22, 2026, and added to the GitHub Advisory Database on September 11, 2026. It affects all versions of shopper/framework prior to 2.9.0, with version 2.8.1 confirmed as vulnerable. The CVSS v3.1 base score is 6.5 (Medium) (GitHub Advisory, Shopper Advisory).

The root cause is CWE-20 (Improper Input Validation): the application assumes discount values are always positive but enforces no such constraint at creation, storage, or calculation time. In vendor/shopper/cart/src/Discounts/DiscountCalculator.php, the raw discount value is read directly ($fixedAmount = $discount->value;) and passed to min($fixedAmount, $applicableSubtotal) — when the value is negative (e.g., -9999999900), min() returns the negative number unchanged, allowing it to flow into CartLineAdjustment::query()->insert($adjustments). In vendor/shopper/cart/src/Pipelines/Calculate.php, the final total is computed as $context->subtotal - $context->discountTotal, so a negative discountTotal (e.g., -5000) causes the total to increase (e.g., 10000 - (-5000) = 15000). Exploitation requires low-privilege authenticated access (administrator role) and no user interaction (GitHub Advisory).

Successful exploitation allows a malicious or compromised administrator to manipulate order totals arbitrarily — for example, inflating a $100 order to $99,999,999 — causing financial data integrity issues, incorrect pricing calculations, and violated assumptions in downstream pricing logic. Because Shopper is a headless e-commerce administration framework without a bundled customer-facing storefront, a direct customer-facing exploitation path was not confirmed; however, any storefront consuming the framework's pricing pipeline would be affected. There is no confidentiality or availability impact, but the high integrity impact reflects the ability to corrupt financial records and order data (GitHub Advisory, Shopper Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires authenticated administrator-level access, which limits the attack surface to insider threats or accounts compromised via other means. The CVE status was listed as "Reserved" at the time of Feedly ingestion, and no EPSS score or CISA KEV catalog entry is currently associated with this CVE (GitHub Advisory).

1. Gain Administrator Access: Log in to the Shopper Framework administrative panel with an account that has discount management privileges.
2. Navigate to Discount Creation: Go to /cpanel/discounts and select the option to create a new discount.
3. Enter a Negative Discount Value: Set the discount type to fixed_amount and enter a negative value such as -99999999. Save the discount record.
4. Confirm Persistence: Verify the discount appears in the admin interface (e.g., Code: TOZKAHCB4S, Amount: -$99,999,999.00) and optionally confirm via database query: SELECT * FROM sh_discounts;.
5. Apply the Discount to an Order: Apply the malicious discount code to a cart or order through the storefront or API integration.
6. Observe Inflated Order Total: The calculation pipeline processes the negative discount, causing the order total to increase rather than decrease (e.g., subtotal $100.00 + negative discount -$99,999,999.00 = inflated total), corrupting financial records (GitHub Advisory).

• Database: Rows in the sh_discounts table with negative values in the amount/value column (e.g., fixed_amount | -9999999900); query: SELECT * FROM sh_discounts WHERE value < 0;
• Database: CartLineAdjustment records with negative adjustment amounts linked to suspicious discount codes.
• Logs: Admin audit logs showing discount creation events with negative values, particularly from unexpected administrator accounts or unusual times.
• Application: Order records with totals exceeding the subtotal (i.e., total > subtotal + tax), indicating a negative discount was applied.
• Network: HTTP POST requests to /cpanel/discounts with a value parameter containing a negative number (GitHub Advisory).

Upgrade shopper/framework to version 2.9.0, which is the patched release that addresses this vulnerability. As a workaround prior to patching, administrators should audit the sh_discounts table for any existing records with negative values and remove or correct them. Additionally, restrict administrative access to the discount management interface to trusted personnel only, and consider adding application-level validation rules enforcing value > 0 for fixed-amount discounts and 0 < value <= 100 for percentage discounts (GitHub Advisory, Shopper Advisory).

The vulnerability was reported by security researcher Fr6ey and published by Shopper Framework maintainer mckenziearts on June 22, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified at this time (Shopper Advisory).