CVE-2026-56829

Executive Summary

CVE-2026-56829 is a missing-authorization vulnerability (CWE-862) in Shopper, a headless e-commerce admin panel. Prior to version 2.9.2, the Livewire component packages/admin/src/Livewire/Components/Products/VariantStock.php exposes a stockAction() method without enforcing edit_product_variants authorization, and leaves its public $variant property client-mutable because it lacks the Livewire Locked attribute.

Because the check is absent, any authenticated admin-panel user — including low-privileged staff holding only browse_products — can manipulate stock levels for arbitrary product variants and inventory locations outside their intended scope. The impact is high integrity loss (stock inflation, stock reduction, or forced out-of-stock states) with no confidentiality or availability impact at the system level; the CVSS base score is 8.1.

Technical Analysis

Shopper is built on Laravel and Laravel Livewire. Livewire components are server-rendered classes whose public properties are synchronized with the browser over subsequent round-trips. This creates two distinct attack surfaces that combine in this CVE:

1. Missing authorization on an action method. The stockAction() method, defined in packages/admin/src/Livewire/Components/Products/VariantStock.php, performs a stock adjustment without verifying that the invoking principal holds the edit_product_variants permission. Authorization is therefore enforced only at the UI layer (the button is hidden from browse-only staff), not at the server-side method that actually executes the mutation. This is a textbook CWE-862 (Missing Authorization) flaw: the operation is reachable by any authenticated session, regardless of role.

2. Client-mutable component state. The component declares public $variant. In Livewire, unless a public property is marked with the Locked attribute, its value can be replaced by the client in a subsequent request payload. Because $variant is not Locked, an attacker is not restricted to the variant rendered on the current page — they can supply an arbitrary product variant identifier and inventory location identifier through the component state. The description explicitly states this "permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page."

The two flaws are chainable and abuse each other. The missing authorization check defeats the role boundary; the absent Locked attribute defeats the scope boundary (current page/target). Neither alone would allow the observed impact: a server-checked edit_product_variants would block browse-only staff, and a locked $variant would confine an authorized user to the variant they already had access to edit.

Attack mechanism at the vulnerability class level: The attacker takes an already-authenticated admin-panel session (any role with browse_products), locates the VariantStock Livewire component, and submits the component action far enough into the Livewire lifecycle to invoke stockAction() with attacker-chosen state for $variant and a positive or negative quantity adjustment. The server processes the adjustment without re-checking the caller's permission and without validating that the targeted variant/location was the one the user was authorized to view.

Prerequisites: A valid authenticated admin-panel account. No special role is required beyond browse_products. The attack vector is network-reachable (AV:N), requires no user interaction beyond the attacker's own actions (UI:N), and no privileges beyond a standard low-privileged authenticated account (PR:L).

Note on detail: No public PoC, exploit code, or Nuclei template exists for this CVE. The description does not disclose the exact wire format, request parameter names beyond the Livewire property $variant, or the precise UI route hosting the component; the analysis above is confined to symbols and behaviors stated verbatim in the NVD description. No further implementation specifics should be assumed.

Exploitation Scenarios

No public PoC is available; the following chain is inferred from the vulnerability class (missing authorization + client-mutable Livewire property) and the NVD description. It uses only names that appear in the source text.

Step 1 — Reconnaissance / target identification. The attacker obtains valid credentials for a Shopper admin panel with, at minimum, the browse_products permission. This could arise from a compromised low-privilege staff account, a shared/contractor login, or credential reuse. The attacker identifies the product variant inventory UI, which is driven by the Livewire component VariantStock (packages/admin/src/Livewire/Components/Products/VariantStock.php).

Step 2 — Trigger setup (defeating scope). Because public $variant is not declared with the Livewire Locked attribute, its value is client-mutable. The attacker crafts a Livewire request that supplies an arbitrary target product variant identifier — one not rendered on the attacker's current page — and an associated inventory location, selected through component state.

Step 3 — Execution (defeating authorization). The attacker invokes the stockAction() method with a positive or negative quantity adjustment. Because stockAction() performs no edit_product_variants authorization check, the request succeeds for a principal who only holds browse_products. No additional privilege escalation is needed; the flaw is the absence of the check, not a bypass of one.

Step 4 — Post-exploitation impact. With one or more crafted requests the attacker can:

• Inflate stock for a variant (positive adjustment), enabling overselling by the storefront since inventory figures are now false.
• Reduce stock (negative adjustment), suppressing availability of legitimate inventory.
• Force out-of-stock states, deliberately making specific variants unsellable.

At the vulnerability-class level, this is unauthorized data manipulation through an exposed server-side action. The attacker never needs permission to edit variants — the missing authorization is the entire exploit.

Impact Assessment

CVSS v3.1: 8.1 (High) — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

• Confidentiality: None (C:N). The flaw modifies stock records; it does not disclose protected data.
• Integrity: High (I:H). Stock quantities are business-critical records. Arbitrary positive/negative adjustments and forced out-of-stock states constitute severe, unauthorized modification of inventory data with direct commercial consequences (overselling, fulfillment failures, demand suppression).
• Availability: High (A:H). Forcing variants out-of-stock removes sellable items from the storefront — an availability impact on the business function itself.
• Attack Vector: Network (AV:N) — exploitable remotely against the admin panel.
• Attack Complexity: Low (AC:L) — no special conditions; a single crafted request path suffices.
• Privileges Required: Low (PR:L) — any authenticated admin-panel user with browse_products.
• User Interaction: None (UI:N).
• Scope: Unchanged (S:U).

Business impact: E-commerce operators running Shopper are exposed. A malicious or careless insider (or an external actor holding a low-privilege staff credential) can corrupt inventory integrity across the entire catalog, not merely the page they can view. Consequences include oversell-driven refunds and reputational damage, deliberate sabotage of competitors' or partners' listings, fulfillment/loss-prevention disruption, and lost revenue from artificially suppressed stock. Because the action is fully authenticated and low-privilege, it blends into normal administrative telemetry.

Blast radius: All product variants and inventory locations are reachable through component state — the authorization gap is not limited to the current page. Any account with browse_products on an affected instance is effectively an inventory-modifying account. No CISA KEV listing, no known in-the-wild exploitation, and no EPSS score is available as of this writing.

Detection Guidance

Detection should focus on authorized-role-to-action mismatches and on stock adjustments originating from sessions lacking edit_product_variants. Since no public PoC exists, rules are behavioral and may require baseline tuning.

Sigma Rule

title: Shopper VariantStock Unauthorized Stock Adjustment (CVE-2026-56829)
id: 7a1c4e2b-9d3f-4c8a-b6e1-2f5a0c9d3e77
status: experimental
description: Detects invocation of Shopper Livewire VariantStock stockAction by a principal lacking edit_product_variants, indicating missing authorization abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-56829
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  product: shopper
  service: admin
detection:
  selection_action:
    action|contains: 'stockAction'
  selection_component:
    component|contains: 'VariantStock'
  filter_authorized:
    user_permissions|contains: 'edit_product_variants'
  condition: (selection_action or selection_component) and not filter_authorized
falsepositives:
  - Legitimate inventory managers whose permissions are represented differently in logs
level: high
tags:
  - attack.t1565.001
  - cve.2026-56829

YARA Rule

rule CVE_2026_56829_Shopper_VariantStock_Unauthorized
{
    meta:
        description = "Detects Shopper VariantStock component lacking Livewire Locked attribute on $variant, relevant to CVE-2026-56829"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-56829"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-01"
        severity = "high"

    strings:
        $file = "VariantStock.php" ascii wide
        $class = "class VariantStock" ascii wide
        $method = "function stockAction" ascii wide
        $prop = "public $variant" ascii wide

    condition:
        uint16(0) == 0x3C3F or $file or ($class and $method and $prop)
}

Note: this YARA rule targets the source file of the vulnerable component for asset-inventory scanning; it is not a malicious-payload signature, since no exploit payload is publicly documented.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-56829 Shopper VariantStock stockAction invocation"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"stockAction"; nocase; http.request_body; content:"VariantStock"; nocase; reference:cve,2026-56829; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-56829; classtype:attempted-admin; sid:2026568290; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where user.roles : "browse_products" and not user.roles : "edit_product_variants" ]
  [ network where event.action == "livewire_request"
      and stringContains(network.request.body, "stockAction")
      and stringContains(network.request.body, "VariantStock") ]

Splunk SPL Query

index=web OR index=app sourcetype=shopper:admin
(uri="*livewire*" OR request_body="*stockAction*" OR component="VariantStock")
| eval has_edit_perm = if(like(permissions,"%edit_product_variants%"),1,0)
| where has_edit_perm=0 AND (match(request_body,"(?i)stockAction") OR match(component,"(?i)VariantStock"))
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as src_ips by user, uri
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="shopper,cve-2026-56829,">
  <rule id="100829" level="12">
    <decoded_as>json</decoded_as>
    <field name="component">VariantStock</field>
    <field name="action">stockAction</field>
    <description>CVE-2026-56829: Shopper VariantStock stockAction invoked - possible missing authorization abuse</description>
    <mitre>
      <id>T1565.001</id>
    </mitre>
    <group>cve_2026_56829,inventory_tampering,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) asserts that the issue is fixed in version 2.9.2. This has not been independently confirmed against an upstream vendor advisory, and no vendor fix text or workaround was provided. Treat the version below as the vendor-claimed fixed release and verify against the official Shopper release notes before relying on it.

1) Immediate mitigations (pre-patch):

• Restrict admin-panel accounts to only those truly requiring access; audit for accounts with browse_products and remove or suspend dormant/shared/low-trust accounts (these are the exploitable population).
• Where feasible, place the admin panel behind network/identity controls (VPN, IP allowlist, SSO with MFA) to reduce the reachable attack surface, consistent with AV:N.
• Monitor for the behavioral indicators in the Detection Guidance section — specifically, stock adjustments originating from sessions that do not hold edit_product_variants.
• If inventory integrity is critical, temporarily reconcile inventory against an authoritative source and alert on unexpected quantity changes or forced out-of-stock transitions.

2) Patch / upgrade steps:

• Upgrade Shopper to 2.9.2 (vendor-claimed fix), following the project's standard update procedure.
• Confirm post-upgrade that stockAction() enforces edit_product_variants and that public $variant is protected with the Livewire Locked attribute, since these two conditions are the root cause. Do not assume the upgrade alone resolves the issue without validating.
• Re-audit admin roles and permissions after the upgrade to confirm least privilege is enforced server-side.

3) Long-term hardening:

• Enforce authorization server-side on every state-changing action (Laravel policies/gates or middleware) — never rely on UI hiding for access control. This directly addresses CWE-862.
• Mark all security-relevant Livewire public properties with the Locked attribute so client-supplied state cannot target resources outside the current context.
• Add automated tests asserting that each Livewire action rejects principals lacking the corresponding permission.
• Adopt defense-in-depth: server-side validation that a requested variant/location is within the caller's authorized scope, plus anomaly alerting on inventory mutations.

References

1. NVD — CVE-2026-56829: https://nvd.nist.gov/vuln/detail/CVE-2026-56829
2. OSV — advisory entry for Shopper (patch source, version 2.9.2 claim): https://osv.dev
3. MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. MITRE ATT&CK T1565.001 — Stored Data Manipulation: https://attack.mitre.org/techniques/T1565/001/
5. Laravel Livewire documentation — Locked attribute and property security: https://livewire.laravel.com/docs/properties

Threat actor / in-the-wild evidence: None. CISA KEV: No. No public PoC, exploit code, or Nuclei template is available. EPSS has not been scored by FIRST.org. Exploitation described herein is inferred from the vulnerability class and the NVD description; no confirmed campaign activity exists as of this writing.