CVE-2026-56825

CVE-2026-56825 is a missing-authorization flaw (CWE-862) in the CollectionProducts Livewire component of the Shopper e-commerce admin panel: the per-record delete action and the bulk delete action have no ->authorize() checks, so the server never verifies the caller's permissions before detaching products. Any authenticated admin-panel session can trigger these actions — including staff whose role only holds browse_collections — and because the public Collection $collection property is not marked #[Locked], the collection ID is mutable in the Livewire wire payload, letting the caller empty any collection in the database, individually or in bulk. An attacker gains integrity and availability impact (CVSS 8.1 High, confidentiality unaffected): products can be detached from arbitrary collections, disrupting storefront merchandising until restored. All Shopper deployments whose admin panel is accessible to minimally privileged staff accounts are affected, while single-trusted-admin stores face negligible risk. No public proof-of-concept, CISA KEV listing, or in-the-wild exploitation has been reported.

What to do: Upgrade Shopper to a release that adds ->authorize() checks to both delete actions and marks the $collection property #[Locked] (fixed version not stated in the advisory — track the vendor's GitHub releases and security advisory). Until patched, restrict admin-panel access to fully trusted administrators and avoid assigning low-privilege roles such as browse_collections to staff. Check collection membership histories for unexplained product removals.