{"metadata": {"vulnerability": "cve-2026-56826", "count": 10, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 4}}, "data": [{"timestamp": "2026-06-23T14:55:09.116Z", "date_only": false, "value": "2026-06-23T14:55:09.116Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-56826", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-09-11T21:28:20Z", "date_only": false, "value": "2026-09-11T21:28:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-F7H9-QV4X-9X57", "record": "GHSA-F7H9-QV4X-9X57", "field": "published"}, {"timestamp": "2026-09-11T21:28:20Z", "date_only": false, "value": "2026-09-11T21:28:20Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-F7H9-QV4X-9X57", "record": "GHSA-F7H9-QV4X-9X57", "field": "modified"}, {"timestamp": "2026-09-11T22:37:18.456Z", "date_only": false, "value": "2026-09-11T22:37:18.456696Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57", "record": "CVE-2026-56826", "field": "creation_timestamp", "uuid": "e1a2c769-8603-420b-beaa-b4a5e59711df", "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57"}, {"timestamp": "2026-10-13T19:11:55.629Z", "date_only": false, "value": "2026-10-13T19:11:55.629Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-56826", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-13T19:11:55.629Z", "date_only": false, "value": "2026-10-13T19:11:55.629Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-56826", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-13T19:11:55.629Z", "date_only": false, "value": "2026-10-13T19:11:55.629Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "cve-2026-56826", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-13T20:17:29.617Z", "date_only": false, "value": "2026-10-13T20:17:29.617", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-56826", "record": "FKIE_CVE-2026-56826", "field": "published"}, {"timestamp": "2026-10-13T20:17:29.747Z", "date_only": false, "value": "2026-10-13T20:17:29.747", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-56826", "record": "FKIE_CVE-2026-56826", "field": "lastModified"}, {"timestamp": "2026-10-14T12:48:20.676Z", "date_only": false, "value": "2026-10-14T12:48:20.676135Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117439338907941413", "record": "CVE-2026-56826", "field": "creation_timestamp", "uuid": "450dedce-86df-422c-b6ef-65914951fced", "content": "CVE-2026-56826 Shopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2.\nhttps://www.cve.org/CVERecord?id=CVE-2026-56826https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57https://github.com/shopperlabs/shopper/pull/570https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ffhttps://github.com/shopperlabs/shopper/releases/tag/v2.9.2#shopperlabs #shopper#CVE_2026_56826#bot", "url": "https://infosec.exchange/users/cve/statuses/117439338907941413"}]}