{
  "affected": [
    {
      "affectedData": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 2.9.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php, packages/admin/src/Livewire/Components/Settings/Zones/Detail.php, packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php, and packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php did not enforce server-side delete authorization. The actions could delete carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation. This issue is fixed in version 2.9.2."
    }
  ],
  "id": "CVE-2026-56826",
  "lastModified": "2026-10-13T20:17:29.747",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-10-13T20:17:29.617",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/pull/570"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopper/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56826"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T21:28:20Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nFour Livewire components in the Settings area expose destructive Filament actions (`delete` / `edit`) that perform **no server-side authorization**. Any authenticated user who can reach the Settings pages \u2014 i.e. holding only the coarse `access_setting` permission, **without** being an admin and **without** any `delete_*`/`edit_*` permission \u2014 can delete tax zones, tax rates, shipping zones, and carrier (shipping-rate) options by invoking the component action directly over the Livewire endpoint.\n\nThese records sit on the storefront checkout path, so deleting them breaks shipping-rate calculation, removes region-scoped payment methods, and corrupts tax resolution at checkout.\n\nThis is inconsistent with the rest of the admin, where destructive actions are gated by granular permissions (e.g. `Settings/Locations/Index` uses `-\u003eauthorize(\u0027delete_inventories\u0027)`, and `Order/Detail` gates mutating actions with `edit_orders`).\n\n## Affected components\n\n| Component | File | Unauthorized action |\n|---|---|---|\n| `Settings\\Zones\\ZoneShippingOptions` | `packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php:47` | `delete` \u2192 `CarrierOption::query()-\u003efind($arguments[\u0027id\u0027])-\u003edelete()` (id is client-supplied) |\n| `Settings\\Zones\\Detail` | `packages/admin/src/Livewire/Components/Settings/Zones/Detail.php:46` | `delete` \u2192 `DeleteAction` on the bound `Zone` |\n| `Settings\\Taxes\\Detail` | `packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php:42` | `delete` \u2192 `DeleteAction` on the bound `TaxZone` |\n| `Settings\\Taxes\\TaxRates` | `packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php:97` | `delete` \u2192 `DeleteAction` on a `TaxRate` |\n\nEach file contains **zero** `authorize` calls, and the actions declare neither `-\u003eauthorize()` nor an enforced `-\u003evisible()` guard.\n\n## Details\n\nThe Settings pages mount these as child Livewire components. The parent page authorizes `access_setting` (e.g. `Pages/Settings/Taxes.php:29`), but the child components do not re-check authorization, and their destructive actions carry no `-\u003eauthorize()`. Because each Livewire component handles its own `/livewire/update` requests, the action executes purely on the page-level `access_setting` gate \u2014 there is no per-resource permission, and `delete_zones` / `delete_taxes` permissions are never even generated by the seeder (`packages/admin/database/seeders/PermissionsTableSeeder.php`).\n\n`ZoneShippingOptions::deleteAction()` is the clearest case \u2014 it deletes by an id taken straight from the client action arguments with no scoping and no permission check:\n\n```php\n// packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php\npublic function deleteAction(): Action\n{\n    return Action::make(\u0027delete\u0027)\n        -\u003erequiresConfirmation()\n        // ... no -\u003eauthorize(), no -\u003evisible()\n        -\u003eaction(function (array $arguments): void {\n            CarrierOption::query()-\u003efind($arguments[\u0027id\u0027])-\u003edelete();   // client-controlled id\n            // ...\n        });\n}\n```\n\n## Proof of Concept\n\nConfirmed with the project\u0027s own test harness (Pest + Orchestra Testbench, SQLite) \u2014 the real Livewire/Filament code path, executed as a non-admin user holding only `access_setting`.\n\n```php\nuse Livewire\\Livewire;\nuse Shopper\\Core\\Models\\{CarrierOption, Zone};\nuse Shopper\\Livewire\\Components\\Settings\\Zones\\ZoneShippingOptions;\nuse Tests\\Core\\Stubs\\User;\n\nuses(Tests\\Admin\\TestCase::class);\n\nit(\u0027low-priv access_setting user deletes a CarrierOption with no authorization\u0027, function (): void {\n    $attacker = User::factory()-\u003ecreate();\n    $attacker-\u003egivePermissionTo(\u0027access_setting\u0027);          // NOT admin, NO delete_* permission\n    $this-\u003eactingAs($attacker, config(\u0027shopper.auth.guard\u0027));\n\n    $zone   = Zone::factory()-\u003ecreate();\n    $option = CarrierOption::factory()-\u003ecreate([\u0027zone_id\u0027 =\u003e $zone-\u003eid]);\n\n    Livewire::test(ZoneShippingOptions::class, [\u0027selectedZoneId\u0027 =\u003e $zone-\u003eid])\n        -\u003ecallAction(\u0027delete\u0027, arguments: [\u0027id\u0027 =\u003e $option-\u003eid]);\n\n    expect(CarrierOption::query()-\u003efind($option-\u003eid))-\u003etoBeNull();   // deleted -\u003e vulnerable\n});\n```\n\nResult:\n\n```\nAttacker: isAdmin()=false, can(\u0027access_setting\u0027)=true, can(\u0027delete_zones\u0027)=false, can(\u0027edit_zones\u0027)=false\n[BEFORE] CarrierOption count = 1  (target #1 \u0027DHL Express\u0027 exists = YES)\n[ATTACK] callAction(\u0027delete\u0027, id=1) on ZoneShippingOptions\n[AFTER ] CarrierOption count = 0  (target #1 exists = NO -\u003e deleted)\n\nPASS  3 passed (11 assertions)\n  \u2713 CONTROL \u2014 Order/Detail::markPaid is correctly hidden without edit_orders (harness enforces declared authz)\n  \u2713 a CarrierOption is deleted by the low-priv user\n  \u2713 a shipping Zone is deleted by the low-priv user\n```\n\nThe CONTROL case rules out a false positive: the same harness correctly denies `Order/Detail::markPaid` for a user lacking `edit_orders`, proving authorization is enforced when a component declares it \u2014 these four components simply declare none.\n\n## Impact\n\nA low-privileged staff member (or a compromised low-privileged account) can sabotage the storefront\u0027s checkout/revenue path without any delete permission:\n\n- **Delete a `CarrierOption`** \u2192 that shipping rate disappears from checkout for the zone.\n- **Delete a `Zone`** \u2192 removes the country \u2192 carrier/payment-method/currency mapping; customers shipping to those countries lose all shipping and payment options (`CarrierRateService::getRatesForZone` / `getManualRates` read these directly).\n- **Delete a `TaxZone` / `TaxRate`** \u2192 `TaxCalculator::resolveZone()` can no longer resolve the zone, corrupting tax calculation at checkout.\n\nNet effect: integrity and availability damage to live commerce configuration, performed by a principal who was never granted that authority (least-privilege violation).\n\n## Secondary issue found while reproducing\n\n`Zones\\Detail::deleteAction()-\u003eafter()` calls `$this-\u003ereset(\u0027zone\u0027)`, but `zone` is a `#[Computed]` method (not a property), so it throws `ReflectionException` **after** the row is deleted. Worth fixing alongside the authorization gap.\n\n## Suggested remediation\n\nAdd an authorization check to each action, and ideally a `mount()` guard on each child component, matching the pattern already used in `Settings/Locations/Index.php` and `Team/RolePermission.php`:\n\n```php\npublic function deleteAction(): Action\n{\n    return Action::make(\u0027delete\u0027)\n        -\u003eauthorize(\u0027access_setting\u0027)   // or a new granular delete_zones / delete_taxes permission\n        -\u003erequiresConfirmation()\n        // ...\n}\n```\n\nApply to the `delete` (and `edit`) actions in all four components. Consider also generating granular `*_zones` / `*_taxes` permissions so settings access can follow least privilege, and fix the `$this-\u003ereset(\u0027zone\u0027)` call in `Zones\\Detail`.",
  "id": "GHSA-f7h9-qv4x-9x57",
  "modified": "2026-09-11T21:28:20Z",
  "published": "2026-09-11T21:28:20Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-f7h9-qv4x-9x57"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopperlabs/shopper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopping privilege escalation through missing authorization in Settings components"
}