CVE-2026-56827

The Shopper e-commerce package for Laravel leaves several Filament `groupedBulkActions` blocks on its admin Livewire pages without permission checks: the bulk delete and enable/disable actions on the attributes, tags, brands, categories, and suppliers pages never call `->authorize()`, while each page's `mount()` only enforces the read-only `browse_*` permission. Any staff account holding just the corresponding browse permission can drive the standard Livewire `callTableBulkAction` endpoint to permanently delete every product attribute or tag (with attribute deletions cascading into dependent product variants) or mass-toggle the `is_enabled` visibility of every brand, category, and supplier. The attacker gains integrity and availability sabotage of the storefront catalog (CVSS 8.1 High, no confidentiality impact) using any low-privilege staff login, with no user interaction. All self-hosted Shopper stores that expose these admin pages to browse-only staff roles are affected through master commit ac9a760; no fixed release version is stated in the available data. No public proof-of-concept and no confirmed exploitation in the wild is known.

What to do: Upgrade to the Shopper release that adds `->authorize()` gates to the affected grouped bulk actions as soon as one is published (no fixed version is given in the available data). Until then, deny browse-only staff roles access to the attributes, tags, brands, categories, and suppliers admin pages, and audit those tables (plus dependent product variants) for unexplained bulk deletions or visibility changes.