CVE-2026-56825

Executive Summary

CVE-2026-56825 is a Missing Authorization (CWE-862) vulnerability in Shopper, a headless e-commerce admin panel, affecting versions prior to 2.9.2. An authenticated staff user holding only the browse_collections permission can abuse a Livewire component that exposes delete actions without enforcing the delete_collections authorization check, allowing them to detach products from or empty arbitrary collections. The impact is high integrity (I:H) with no confidentiality or availability loss at the CVSS framework level, yielding a base score of 8.1.

Technical Analysis

The vulnerability resides in the file packages/admin/src/Livewire/Components/Collection/CollectionProducts.php, which defines two Livewire actions: Action::make('delete') and DeleteBulkAction::make(). These actions are exposed to the frontend via Livewire's component action invocation mechanism, but the component does not enforce the delete_collections authorization gate before executing them. Consequently, any authenticated staff principal with the lower-privileged browse_collections permission can trigger the removal logic.

Compounding the issue, the public property public Collection $collection is client-mutable because it lacks Livewire's Locked attribute. Livewire serializes public properties to the client and rehydrates them on each subsequent request; without the Locked attribute, an attacker can substitute an arbitrary collection identifier in the request payload. This transforms a permission-bounded action into an authorization bypass with IDOR-like characteristics: the actor need not possess delete_collections nor own the targeted collection — they simply supply a different collection ID.

The result is unauthorized detachment of products from collections or complete emptying of a collection. The affected asset is the CollectionProducts Livewire component representing the product-to-collection relationship. The Common Weakness Enumeration class is CWE-862 (Missing Authorization), mapped at the server-side action layer rather than at the data layer. The CVSS v3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H reflects a network-reachable issue requiring low privileges, no user interaction, and causing high integrity impact without scope change.

Notably, the vendor/product fields are marked "Unknown / Unknown" in the supplied data, but the NVD description identifies the product as "Shopper" (a Headless e-commerce Admin Panel). No public proof-of-concept, Nuclei template, or exploit code is currently available, and the EPSS score has not yet been assigned by FIRST.org.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (missing authorization plus client-mutable property) as described by NVD.

1. Reconnaissance / Target Identification. The attacker identifies a Shopper admin panel (version < 2.9.2) reachable over the network. The actor must already possess a valid authenticated staff session with at least the browse_collections permission — this may be obtained through legitimate provisioning, credential reuse, or phishing of a low-privilege staff account.

2. Triggering the Flaw Class. With an authenticated session, the attacker navigates to (or directly invokes) the CollectionProducts Livewire component. Because neither Action::make('delete') nor DeleteBulkAction::make() performs a delete_collections authorization check, the action handler proceeds without verifying the caller's rights.

3. Payload / Execution at the Vulnerability-Class Level. Livewire component actions are invoked by posting the component's public state and action name to the Livewire endpoint. Since public Collection $collection is not protected by the Locked attribute, the attacker can alter the collection identifier in that payload to reference a collection they do not own and should not be able to modify. The submitted removal action then executes against the substituted collection target — the classic client-controlled-identifier authorization bypass pattern.

4. Post-Exploitation Impact. The selected products are detached from the victim collection, or the collection is emptied entirely. Dependent storefront experiences — catalog landing pages and promotions tied to that collection — degrade or break. Because the change is an integrity violation rather than a confidentiality or availability compromise of the host, the attacker remains stealthy until merchandising or monitoring teams observe product listings disappearing.

Impact Assessment

The CVSS v3.1 base score is 8.1 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Subscores indicate:

• Attack Vector (N): exploitable remotely over the network against the admin panel.
• Attack Complexity (L): no special conditions; Livewire action invocation is predictable.
• Privileges Required (L): only a low-privileged authenticated staff account with browse_collections is needed.
• User Interaction (N): no victim interaction required.
• Scope (U): the security authority of the vulnerable component is unchanged.
• Confidentiality (N) / Integrity (H) / Availability (H... actually A:H per vector): wait — vector shows A:H, so availability impact is high as well as integrity. The vector supplied is C:N/I:H/A:H, so both integrity and availability are High while confidentiality is None.

Wait — the vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, which includes A:H. This means the vulnerability can also impact availability, consistent with destructive emptying of collections that disrupts live storefront functionality.

Blast Radius: Any Shopper deployment running a version below 2.9.2 with Livewire exposed. Because the actor can substitute arbitrary collection identifiers, the blast radius is not limited to the attacker's own collections — it can extend to every collection defined in the store, including customer-facing landing pages and promotional collections. Note, however, that the NVD description states the impact centers on disrupting "catalog landing pages and promotions associated with the targeted collection." There is no evidence of ransomware or data exfiltration, and no CISA KEV listing.

The primary affected asset is the commerce content pipeline (collections drive merchandising), not the payment or PII systems. Business impact is therefore revenue and brand impact via broken storefront experiences rather than regulatory exposure.

Detection Guidance

Sigma Rule

title: Shopper Livewire CollectionProducts Unauthorized Delete Action
id: 9f2c1a76-4d1e-4c9a-8e2b-3a7c5f0b1e42
status: experimental
description: Detects attempts to invoke delete actions on the Livewire CollectionProducts component without expected authorization, per CVE-2026-56825.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-56825
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_endpoint:
    cs-uri-query|contains: 'livewire'
  selection_component:
    cs-uri-query|contains: 'CollectionProducts'
  selection_action:
    cs-uri-query|contains|any:
      - 'delete'
      - 'DeleteBulkAction'
  condition: selection_endpoint and (selection_component or selection_action)
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
  - cs-method
falsepositives:
  - Legitimate administrators with delete_collections permission performing normal maintenance
level: medium
tags:
  - attack.t1565.001
  - cve.2026.56825

YARA Rule

rule CVE_2026_56825_Shopper_Livewire_Unauthorized_Delete
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects references to the vulnerable Livewire CollectionProducts delete actions in Shopper < 2.9.2"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-56825"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "CollectionProducts.php" ascii wide
        $p2 = "DeleteBulkAction::make" ascii wide
        $p3 = "delete_collections" ascii wide
        $p4 = "browse_collections" ascii wide
        $p5 = "Livewire\\Components\\Collection" ascii wide

    condition:
        uint16(0) == 0x3C3F or uint16(0) == 0x7B7B or
        (any of ($p1, $p2, $p5) and any of ($p3, $p4))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-56825 Shopper Livewire CollectionProducts Unauthorized Delete Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"livewire"; http.uri; content:"CollectionProducts"; http.request_body; content:"delete"; nocase; reference:cve,2026-56825; classtype:attempted-admin; sid:202656825; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "POST" and
      http.request.uri : "livewire" and
      http.request.uri : "CollectionProducts" ]

Splunk SPL Query

index=web_logs sourcetype=access_common
| search uri_path="*livewire*" OR uri_query="*CollectionProducts*" OR uri_query="*DeleteBulkAction*"
| eval severity=if(match(uri_query,"(?i)delete") AND match(uri_query,"(?i)CollectionProducts"),"high","low")
| where severity="high"
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,syscheck,cve-2026-56825,">
  <rule id="2026568" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>/.*livewire.*CollectionProducts.*/</url>
    <regex_type>pcre2</regex_type>
    <description>CVE-2026-56825: Potential unauthorized Shopper Livewire CollectionProducts delete action</description>
    <mitre>
      <id>T1565.001</id>
    </mitre>
    <group>attack,cve-2026-56825,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations (when patching cannot be applied at once):

   • Restrict network access to the Shopper admin panel (allow-list trusted IPs, place behind VPN/SSO) so only authenticated, trusted staff can reach the Livewire endpoint.
   • Audit staff accounts and strip unnecessary browse_collections grants from low-privilege users until the authorization check is fixed.
   • Monitor for anomalous Livewire POST requests referencing CollectionProducts deletion actions and alert on those originating from users without the delete_collections permission.
   • Take cold backups of collection-to-product mapping tables so unauthorized modifications can be reverted.

2. Patch / Upgrade Steps:

   • Upgrade Shopper to version 2.9.2 or later, which per the vendor's NVD description fixes the missing authorization check and the Livewire client-mutability issue.
   • After upgrading, verify that delete_collections authorization is enforced on both Action::make('delete') and DeleteBulkAction::make(), and that the Collection property has been locked. Because patch confidence is only 2/4, independently review the changelog and source diff between 2.9.2 and the prior release before relying on the fix.
   • Re-validate the integrity of collection contents post-patch.

3. Long-Term Hardening:

   • Enforce authorization checks at the server-side action handler layer, not just at UI rendering, following defense-in-depth principles.
   • Mark all public Livewire properties with Locked attributes when they should not be client-mutable, and adopt a project-wide policy requiring this for any property referencing persistent identifiers.
   • Implement structured logging and alerting for permission-sensitive action invocations, mapping each action to the required permission.
   • Apply least-privilege and role-based access controls to all e-commerce merchandising roles, and periodically run authorization-bypass tests against Livewire components.

References

• NVD — CVE-2026-56825: https://nvd.nist.gov/vuln/detail/CVE-2026-56825
• OSV entry for CVE-2026-56825: https://osv.dev/vulnerability/CVE-2026-56825
• Shopper project homepage / release notes: https://github.com/shopperlabs/shopper (verify 2.9.2 release notes for the fix)
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Livewire security documentation (Locked attributes and component properties): https://livewire.laravel.com/docs/properties

Exploit-in-the-wild / threat actor evidence: None currently known. No Nuclei template, public PoC, or exploit code is available; CISA KEV does not list this CVE. EPSS has not yet been scored by FIRST.org.