GHSA-f946-9qp6-vgch

Suggest an improvement
Source
https://github.com/advisories/GHSA-f946-9qp6-vgch
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f946-9qp6-vgch/GHSA-f946-9qp6-vgch.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f946-9qp6-vgch
Aliases
Published
2026-05-18T16:34:23Z
Modified
2026-09-10T03:50:46Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
Summary
shopper/framework: Authorization bypass in multiple Livewire admin components
Details

Impact

Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission:

  • Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with read_orders only and did not require edit_orders. capturePayment could trigger an actual PSP capture.
  • Order shipments table actions (mark delivered, edit tracking) were callable with browse_orders only.
  • Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on store(), so any authenticated panel user could mutate product data without edit_products.
  • Settings/Team/Index had no mount() authorization at all — any authenticated user could create roles and delete other users.
  • Settings/Team/RolePermission gated its write actions on the read-only view_users permission, allowing privilege escalation via the RBAC system itself.
  • PaymentMethods, Currencies, Carriers table toggles and per-record actions had no per-action permission check.
  • Customers/Create::store() re-passed a Hidden _password form field into the create payload.

Several public Eloquent model properties on Livewire components were not #[Locked], allowing client-side ID tampering.

A stored XSS surface existed on the product barcode field, which is rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}.

Patches

Fixed in v2.8.0. Upgrade via:

composer require shopper/admin:^2.8 shopper/cart:^2.8 shopper/core:^2.8

php artisan migrate

Workarounds

None. Upgrade to v2.8.0.

Resources

Database specific 
{
    "cwe_ids":  [
        "CWE-285",
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-18T16:34:23Z",
    "nvd_published_at":  "2026-05-29T19:16:25Z",
    "severity":  "HIGH"
}
References

Affected packages

Packagist / shopper/framework

Package

Name
shopper/framework
Purl
pkg:composer/shopper/framework

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.8.0

Affected versions

v2.*
v2.0.0-alpha
v2.0.0-beta
v2.0.0-beta2
v2.0.0-beta3
v2.0.0-beta4
v2.0.0-beta5
v2.0.0-beta6
v2.0.0-beta7
v2.0.0-beta8
v2.0.0-beta9
v2.0.0-beta10
v2.0.0-beta11
v2.0.0-beta12
v2.0.0-beta13
v2.0.0-beta14
v2.0.0-beta15
v2.0.0-beta16
v2.0.0-beta17
v2.0.0-beta18
v2.0.0-beta19
v2.0.0-beta20
v2.0.0-beta21
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.1.6
v2.2
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.2.5
v2.2.6
v2.2.7
v2.3
v2.3.1
v2.3.2
v2.3.3
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.5.0
v2.5.1
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.7.0
v2.7.1
v2.7.2
v2.7.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-f946-9qp6-vgch/GHSA-f946-9qp6-vgch.json"