Skip to content
OpenAdvisories

Package · Packagist

shopper/framework

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 8.8
    CVE-2026-56828

    Shopper: read-only team permissions allow administrator creation and permission escalation

    Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps after the earlier team-settings authorization fix. A staff member with only `view_users` and `access_dashboard` can mutate …

    shopperlabs shopper shopper/framework Packagist
  • High 8.1
    CVE-2026-56827

    Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/Livewire/Pages/Tag/Index.php, packages/admin/src/Livewire/Pages/Brand/Index.php, packages/admin/src/…

    shopperlabs shopper shopper/framework Packagist
  • High 8.1
    CVE-2026-56829

    Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Liv…

    shopperlabs shopper shopper/framework Packagist
  • High 8.1
    CVE-2026-56825

    Shopper: Missing authorization on product removal actions in CollectionProducts component

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collectio…

    shopperlabs shopper shopper/framework Packagist
  • High 8.7
    CVE-2026-47743

    Shopper: Multiple data integrity and disclosure issues in admin Livewire components

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model id…

    shopperlabs shopper shopper/framework Packagist
  • High 8.1
    CVE-2026-47740

    Shopper: Authorization bypass in multiple Livewire admin components

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orders. The order detail…

    shopperlabs shopper shopper/framework Packagist