CVE-2026-56826

Executive Summary

CVE-2026-56826 is an authorization bypass vulnerability (CWE-862, Missing Authorization) in Shopper, a headless e-commerce admin panel. From version 2.0.0 until 2.9.2, authenticated users holding only the access_setting permission could directly invoke destructive settings actions through the Livewire endpoint, bypassing server-side delete authorization checks. Successful exploitation allows deletion of carrier options, shipping zones, tax zones, and tax rates, disrupting checkout shipping, payment-method mapping, and tax calculation.

Technical Analysis

The vulnerability resides in four Livewire components within the admin package:

• packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php
• packages/admin/src/Livewire/Components/Settings/Zones/Detail.php
• packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php
• packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php

These components expose destructive actions (delete carrier options, shipping zones, tax zones, tax rates) that are reachable via the Livewire endpoint. The core defect is that these components did not enforce server-side delete authorization. While the UI may gate access to the Settings pages behind access_setting, the underlying Livewire action handlers lacked the corresponding authorization check required to perform deletion. This is a classic CWE-862 Missing Authorization issue: the application relies on UI-level access control rather than enforcing authorization at the server-side action boundary.

Because Livewire actions are invoked as HTTP requests to a public endpoint, any authenticated user who can reach the Settings pages with only access_setting can craft a request directly to the vulnerable component actions. The absence of a server-side authorization check means the request succeeds regardless of whether the user has delete privileges. The result is unauthorized deletion of configuration records — carrier options, shipping zones, tax zones, and tax rates — with direct functional impact on the storefront's checkout and financial calculations.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) reflects a network-reachable, low-complexity attack requiring low privileges (authenticated user), no user interaction, with limited integrity and availability impact. There is no confidentiality impact, consistent with a destructive configuration-deletion flaw rather than a data exfiltration issue.

No public PoC, exploit code, or Nuclei template is available. The precise request structure (Livewire payload shape, component identifiers, method names) is not disclosed in the NVD description and should not be assumed; detection should focus on anomalous deletion activity against the four named settings components.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-862 Missing Authorization) and the NVD description.

1. Reconnaissance / Target Identification: An attacker identifies a Shopper-based admin panel (headless e-commerce admin) and obtains valid credentials for an account with the access_setting permission. This may be a low-privileged staff, support, or integration account that can reach the Settings pages but is not intended to have destructive configuration rights. The attacker locates the Livewire endpoint used by the admin panel.

2. Triggering the Flaw Class: Because the four named components — Zones/ZoneShippingOptions.php, Zones/Detail.php, Taxes/Detail.php, and Taxes/TaxRates.php — do not enforce server-side delete authorization, the attacker does not need delete privileges. They reach the Settings pages (permitted by access_setting) and identify the destructive actions (delete carrier options, shipping zones, tax zones, tax rates) exposed by these components.

3. Payload / Execution Method (vulnerability-class level): The attacker invokes the destructive Livewire component actions directly. Since authorization is only enforced at the UI/access level and not on the server-side action handlers, the delete operation executes. The attacker repeats this against the four affected components to delete carrier options, shipping zones, tax zones, and tax rates.

4. Post-Exploitation Impact: The deletions disrupt checkout shipping (shipping zones and carrier options removed), payment-method mapping, and tax calculation (tax zones and tax rates removed). This degrades or halts storefront functionality and can cause financial misconfiguration. There is no evidence of data exfiltration (C:N) or scope change (S:U); impact is limited integrity and availability (I:L/A:L). Deleting configuration is potentially reversible only if backups or prior configuration records exist.

Impact Assessment

The business impact centers on operational disruption to an e-commerce platform's checkout and financial configuration. Deletion of carrier options and shipping zones removes or breaks shipping selection at checkout; deletion of tax zones and tax rates breaks tax calculation and, per the description, payment-method mapping. Because these are settings records, the immediate blast radius is the affected store's checkout, shipping, and tax functions rather than wholesale system compromise.

CVSS 3.1 subscores explain the measured risk:

• AV:N — exploitable over the network via the admin panel's Livewire endpoint.
• AC:L — no special conditions or race; a straightforward authenticated request.
• PR:L — requires low privileges: an authenticated account able to reach Settings with only access_setting.
• UI:N — no victim interaction required.
• S:U — impact confined to the vulnerable component.
• C:N — no confidentiality impact.
• I:L — limited integrity impact (configuration records deleted).
• A:L — limited availability impact (checkout shipping, payment-method mapping, tax calculation disrupted).

Affected systems are Shopper installations running versions 2.0.0 through 2.9.1. There is no CISA KEV listing and no known exploit-in-the-wild evidence. The EPSS score of 0.00278 (18.9th percentile) indicates low predicted exploitation likelihood at time of analysis, though the low privilege requirement and destructive outcome warrant monitoring.

Detection Guidance

Sigma Rule

title: Shopper Admin Settings Destructive Livewire Action by Low-Privilege User
id: 6f4c9b1e-2d77-4a3e-9c5b-0e1f7a2b4d10
status: experimental
description: Detects destructive Livewire action requests targeting Shopper settings
  components (Zones/ZoneShippingOptions, Zones/Detail, Taxes/Detail, Taxes/TaxRates)
  from accounts that should not have delete authorization (CVE-2026-56826).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-56826
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
  product: generic
detection:
  selection_path:
    cs-uri-path|contains:
      - 'livewire'
  selection_component:
    cs-uri-query|contains:
      - 'ZoneShippingOptions'
      - 'Zones/Detail'
      - 'Taxes/Detail'
      - 'TaxRates'
  selection_action:
    cs-uri-query|contains:
      - 'delete'
      - 'remove'
  condition: selection_path and (selection_component or selection_action)
falsepositives:
  - Legitimate administrators performing authorized settings deletions
level: medium

YARA Rule

rule CVE_2026_56826_Shopper_Missing_Authorization
{
    meta:
        description = "Detects Shopper admin Livewire settings components affected by CVE-2026-56826 (CWE-862 missing server-side delete authorization)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-56826"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $c1 = "ZoneShippingOptions" ascii wide
        $c2 = "Settings/Zones/Detail" ascii wide
        $c3 = "Settings/Taxes/Detail" ascii wide
        $c4 = "Settings/Taxes/TaxRates" ascii wide
        $path1 = "packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php" ascii
        $path2 = "packages/admin/src/Livewire/Components/Settings/Zones/Detail.php" ascii
        $path3 = "packages/admin/src/Livewire/Components/Settings/Taxes/Detail.php" ascii
        $path4 = "packages/admin/src/Livewire/Components/Settings/Taxes/TaxRates.php" ascii
        $access = "access_setting" ascii

    condition:
        (2 of ($c*) and $access) or any of ($path*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-56826 Shopper Admin Destructive Settings Livewire Action"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"livewire"; http.uri; content:"ZoneShippingOptions"; http.uri; content:"delete"; classtype:attempted-admin; reference:cve,2026-56826; sid:2026568260; rev:1;)

alert http any any -> any any (msg:"CVE-2026-56826 Shopper Admin Tax Settings Deletion (TaxRates/Detail)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"livewire"; http.uri; content:"TaxRates"; http.uri; content:"delete"; classtype:attempted-admin; reference:cve,2026-56826; sid:2026568261; rev:1;)

Elastic Detection

sequence by user.name with maxspan=2m
  [ http.request where http.request.method == "POST" and
      http.request.uri contains "livewire" and
      http.request.uri contains "ZoneShippingOptions" ]
  [ http.request where http.request.method == "POST" and
      http.request.uri contains "livewire" and
      (http.request.uri contains "delete" or http.request.uri contains "remove") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri_lower = lower(uri)
| where match(uri_lower, "livewire")
| where match(uri_lower, "zoneshippingoptions|settings/zones/detail|settings/taxes/detail|taxrates")
| where match(uri_lower, "delete|remove")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris by src_ip, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,shopper,cve-2026-56826,">
  <rule id="100626" level="10">
    <if_sid>31100</if_sid>
    <url>livewire</url>
    <description>CVE-2026-56826: Shopper admin Livewire settings action referencing destructive zone/tax component</description>
    <regex>ZoneShippingOptions|settings/zones/detail|settings/taxes/detail|TaxRates</regex>
    <group>cve_2026_56826,unauthorized_delete,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The only patch source is the GHSA advisory; the fix should be validated against the referenced version before relying on it.

1. Immediate Mitigations

   • Upgrade Shopper to version 2.9.2 or later, where the issue is stated to be fixed.
   • If immediate upgrade is not possible, restrict the access_setting permission to a minimal set of trusted accounts and audit which accounts currently hold it.
   • Restrict network access to the admin panel and Livewire endpoint (VPN, allowlist, or IP restriction).
   • Ensure reliable backups of shipping zones, carrier options, tax zones, and tax rates exist so deletions can be restored.
   • Monitor/alert on destructive settings actions performed by accounts that should not have delete rights.

2. Patch / Upgrade Steps

   • Confirm your installed Shopper version (vulnerable range: 2.0.0 through 2.9.1).
   • Apply the 2.9.2 update via your standard dependency/composer workflow.
   • Because patch confidence is only CLAIMED (2/4, single source), verify the fix independently: confirm the four components (Zones/ZoneShippingOptions.php, Zones/Detail.php, Taxes/Detail.php, Taxes/TaxRates.php) now enforce server-side delete authorization before destructive actions execute.
   • Review the GHSA advisory for the exact commit or release artifact.

3. Long-Term Hardening

   • Enforce authorization at the server-side action boundary, not only at the UI/page-access level; every destructive Livewire action should re-check privileges server-side.
   • Apply least-privilege role design so that access_setting does not implicitly grant delete capabilities.
   • Add regression tests that attempt destructive actions with a low-privilege account and assert denial.
   • Log and alert on configuration-deletion events affecting shipping, tax, and payment-method mapping.

References

• NVD — CVE-2026-56826: https://nvd.nist.gov/vuln/detail/CVE-2026-56826
• GitHub Security Advisory (GHSA) for Shopper, fixed in 2.9.2 — source of the claimed patch (single source, not independently confirmed).
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• CVSS 3.1 Specification — https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-56826 is NOT listed) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template were identified for CVE-2026-56826 at time of analysis. EPSS 0.00278 (18.9th percentile) — low predicted exploitation activity.