CVE-2026-56830: Broken Function Level Authorization in Shopper Media Component

Vulnerability ID: CVE-2026-56830
CVSS Score: 6.5
Published: 2026-09-11

An incomplete security fix in Shopper prior to version 2.9.2 exposes a Broken Function Level Authorization (BFLA) vulnerability in the Media component. Low-privileged administrative users with 'browse_products' permissions can bypass role-based access control policies to execute the 'store' action and modify product media.

TL;DR

Missing server-side authorization in Shopper's Livewire Media component allows low-privilege staff to maliciously overwrite product images.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-862
• Attack Vector: Network (AV:N)
• CVSS v3.1 Score: 6.5
• Impact: High Integrity Loss (I:H)
• Exploit Status: Proof of Concept (PoC) Available
• CISA KEV Status: Not Listed

Affected Systems

• Shopper (shopperlabs/shopper) Headless E-Commerce Admin Panel
• shopperlabs/shopper: < 2.9.2 (Fixed in: 2.9.2)

Code Analysis

Commit: bf72e27

fix(admin): enforce authorization on unguarded settings and bulk actions (#570)

@@ -63,6 +63,8 @@ public function form(Schema $schema): Schema

     public function store(): void
     {
+        $this->authorize('edit_products');
+
         $this->validate();

         $this->product->update($this->form->getState());

Exploit Details

• PoC Documentation: Exploit methodology and manual curl/Python instructions documented in security advisory GHSA-99h5-jhh7-v3r3

Mitigation Strategies

• Upgrade Shopper package to version 2.9.2 or higher
• Manually apply authorization checks in Media.php
• Deploy WAF rules to inspect Livewire update requests

Remediation Steps:

1. Execute 'composer update shopperlabs/shopper' to update to version 2.9.2 or later
2. Verify that the Media.php file contains the 'authorize' call in the 'store' method
3. Deploy Web Application Firewall policies to monitor and block abnormal /livewire/update requests

References

• GitHub Security Advisory GHSA-99h5-jhh7-v3r3
• Fix Commit in Shopper Repository
• Pull Request #570
• Shopper v2.9.2 Release Notes
• CVE-2026-56830 Record
• Wiz Vulnerability Database - CVE-2026-56830

Read the full report for CVE-2026-56830 on our website for more details including interactive diagrams and full exploit analysis.