Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
12 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neither the Action::make('delete') at line 73 nor the DeleteBulkAction::make() at line 91 carries an -authorize(...) chain. The component also exposes public Collection $collection without #[Locked], so the collection ID is mutable in the Livewire wire payload. Any authenticated admin-panel session, including staff who hold only browsecollections, can detach individual products or bulk-detach all products from any collection in the database. Severity CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Score: 8.1 (High) Affected files - packages/admin/src/Livewire/Components/Collection/CollectionProducts.php:40,73-88,91-105 Steps to reproduce Prerequisites: any admin-panel account, including one whose role…
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Title Missing authorization on Media sub-form store action allows unpermissioned product media update Description A lack of authorization control on the store() method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph added #[Locked] to the $product property in this file but did not add an authorize() call to store(). The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only browseproducts, can invoke store() on this component to replace the thumbnail and gallery images for any product without holding editproducts. Because $product is now #[Locked], the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent,…
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Title Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component Description A lack of authorization control was discovered in the stockAction() method in packages/admin/src/Livewire/Components/Products/VariantStock.php. The component exposes a public $variant property without the #[Locked] attribute, so the variant ID is client-mutable via the Livewire wire payload. The stockAction() returns an Action with no -authorize(...) chain, meaning any authenticated admin-panel session, including browse-only staff who hold zero edit permissions, can call this action to adjust inventory levels for any product variant. The combination of missing authorization and an unlocked model binding lets the attacker both bypass the permission gate and redirect the mutation to an arbitrary variant in the database. Severity CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Score: 8.1 (High) Affected files -…
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Three Livewire admin components in shopper/framework (latest master at commit fcd0c59, released as v2.8.0) gate state-mutating actions on the read-only viewusers permission. This is the same class as the issue Shopper fixed in v2.8.0 / PR #511 / GHSA-f946-9qp6-vgch — the PR moved most write actions from viewusers to accesssetting, but three were missed (one of them is a brand-new file added by the security commit itself). A staff user holding only viewusers + accessdashboard (a realistic "support" or "viewer" role per Shopper's own PermissionsTableSeeder) can: (1) self-escalate by granting any permission to their own role; (2) create a brand-new admin team member with a chosen password and the admin role and then log in as that user; (3) delete arbitrary permissions rows (RBAC DoS) or — when canberemoved=true — delete entire roles. CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 (High). CWE-285 (Improper Authorization) + CWE-862 (Missing Authorization). Vulnerable…
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Four Livewire components in the Settings area expose destructive Filament actions (delete / edit) that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without any delete/edit permission — can delete tax zones, tax rates, shipping zones, and carrier (shipping-rate) options by invoking the component action directly over the Livewire endpoint. These records sit on the storefront checkout path, so deleting them breaks shipping-rate calculation, removes region-scoped payment methods, and corrupts tax resolution at checkout. This is inconsistent with the rest of the admin, where destructive actions are gated by granular permissions (e.g. Settings/Locations/Index uses -authorize('deleteinventories'), and Order/Detail gates mutating actions with editorders). Affected components | Component | File | Unauthorized action | |---|---|---| |…
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Shopper Framework discount management functionality accepts negative discount values without server-side validation. It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline. The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation. As a result, malformed discount records can influence financial calculations and produce unintended order totals. --- Affected Product Package: shopper/framework Version Tested: 2.8.1 --- Vulnerability Type Business Logic Vulnerability Improper Input Validation (CWE-20) --- Description While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface. Example values tested: The application accepted these values without…
Recommended action: Upgrade to 2.9.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize(...) permission gate, while their per-record sibling actions (and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and Pages/Discount/Index.php) correctly chain -authorize(...). Each affected page's mount() only requires the read-only browse permission, so a low-privilege staff user holding only the read permission can drive the bulk endpoint via the standard Livewire callTableBulkAction flow and execute state-mutating operations they were never granted. The vulnerability is the same class as GHSA-f946-9qp6-vgch and GHSA-j328-xmgp-j4q3 (read-only permission gating a write action), just on a different surface (Filament 4 groupedBulkActions rather than top-level Livewire methods). A staff user holding only browseattributes can permanently delete every product attribute in the catalog (cascading break of every…
Recommended action: Upgrade to 2.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Two distinct authorization defects in the team settings allowed any authenticated panel user to take over the RBAC system: - Settings/Team/Index had no mount() authorization. Any authenticated user could load the page and use its public actions to create new roles and delete other users, including administrators. - Settings/Team/RolePermission gated its write actions on the read-only viewusers permission. Any user holding viewusers could grant themselves or any other user arbitrary permissions, including manageusers and editorders, effectively escalating to full panel administrator from a read-only account. Combined, these two defects allow a low-privilege authenticated user to obtain administrator privileges and remove the legitimate administrators from the panel. Patches Fixed in v2.8.0: - Settings/Team/Index::mount() now authorizes against manageusers. - Settings/Team/RolePermission write actions now require manageusers instead of viewusers. Upgrade via: Workarounds None.…
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS: - IDOR via unlocked properties. Several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without the #[Locked] attribute. An authenticated user could rewrite the wire payload from the browser to target any record id, bypassing the implicit scoping enforced by the page routing. - Sensitive data echoed back through Hidden form field. Customers/Create::store() re-passed a Hidden password form field straight into the create payload. The plaintext password was rendered into the HTML and transported through the Livewire snapshot in clear text, exposing credentials in the page DOM and in any logging that captures Livewire payloads. - Stored XSS on product barcode. The product barcode field was rendered through DNS1DFacade::getBarcodeHTML() with {!! !!}. An attacker with editproducts permission could persist malicious…
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could: - Disable every payment method on the store, blocking checkout. - Disable or alter the default currency, changing displayed prices and the exchange rate basis. - Disable carriers, breaking shipping rate computation at checkout. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. Patches Fixed in v2.8.0. Each toggle and per-record action now requires its matching permission (editpaymentmethods, editcurrencies, editcarriers). Upgrade via: Workarounds None. Upgrade to v2.8.0.
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding editproducts. The affected components accepted the product ID as a public Livewire property without #[Locked], so an attacker could also target an arbitrary product by tampering with the wire payload from the client. Patches Fixed in v2.8.0. Each sub-form store() now authorizes against editproducts and the product binding is locked. Upgrade via: Workarounds None. Upgrade to v2.8.0. References - Pull request: https://github.com/shopperlabs/shopper/pull/511 - CWE-862 Missing Authorization
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Multiple Livewire components in the admin panel allowed an authenticated low-privilege user to mutate data without the required permission: - Order detail Filament actions (cancel, mark paid, mark complete, capture payment, archive, start processing) were callable with readorders only and did not require editorders. capturePayment could trigger an actual PSP capture. - Order shipments table actions (mark delivered, edit tracking) were callable with browseorders only. - Sub-form Livewire components for products (Edit, Inventory, Seo, Shipping, Files) had no authorization on store(), so any authenticated panel user could mutate product data without editproducts. - Settings/Team/Index had no mount() authorization at all — any authenticated user could create roles and delete other users. - Settings/Team/RolePermission gated its write actions on the read-only viewusers permission, allowing privilege escalation via the RBAC system itself. - PaymentMethods, Currencies, Carriers table…
Recommended action: Upgrade to 2.8.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.