CVE-2026-56829

CVE-2026-56829 is a missing-authorization flaw (CWE-862) in the VariantStock Livewire component of the Shopper e-commerce framework's admin panel. The component declares its model binding as a plain public $variant property without the #[Locked] attribute, and its stockAction() action carries no ->authorize() check, so an authenticated admin-panel user can tamper with the Livewire wire payload to point the action at any variant ID in the database. As a result, any staff account with a valid panel session — even one holding only browse-level permissions and no product-edit rights — can add or subtract stock quantities on arbitrary variants, corrupting inventory integrity (enabling overselling or concealment of stock movements). All stores running the affected Shopper admin package are exposed, though exploitation requires an authenticated panel account, so single-operator shops face minimal risk. No public proof-of-concept, in-the-wild exploitation, or KEV listing is currently known.

What to do: Upgrade Shopper to the patched release indicated in the vendor's security advisory; as an interim fix, add the #[Locked] attribute to the $variant property and chain an ->authorize() permission check (e.g., a product-variant edit permission) onto the stock Action in VariantStock.php. Review recent inventory mutations for unexplained adjustments and limit admin-panel accounts to trusted staff.