PT-2026-90543 · Packagist · Shopper/Framework

CVE-2026-56827

·

Published

2026-09-11

·

Updated

2026-09-11

CVSS v3.1

8.1

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Summary

Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the ->authorize(...) permission gate, while their per-record sibling actions (and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and Pages/Discount/Index.php) correctly chain ->authorize(...). Each affected page's mount() only requires the read-only browse * permission, so a low-privilege staff user holding only the read permission can drive the bulk endpoint via the standard Livewire callTableBulkAction flow and execute state-mutating operations they were never granted. The vulnerability is the same class as GHSA-f946-9qp6-vgch and GHSA-j328-xmgp-j4q3 (read-only permission gating a write action), just on a different surface (Filament 4 groupedBulkActions rather than top-level Livewire methods).
A staff user holding only browse attributes can permanently delete every product attribute in the catalog (cascading break of every dependent product variant). A user holding only browse tags can permanently delete every product tag. Users holding browse brands, browse categories, or browse suppliers can flip the visibility (is enabled) of every brand/category/supplier in bulk, sabotaging storefront catalog visibility.
CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H = 8.1 High. CWE-285 (Improper Authorization) and CWE-862 (Missing Authorization). The attacker has low privilege (browse-only staff role), no user interaction, network reachable.

Vulnerable components (paths relative to repo root)

All references are HEAD = commit ac9a760 on master (the very commit that closed the previous wave of authorization-drift bugs from GHSA-j328-xmgp-j4q3).

1) packages/admin/src/Livewire/Pages/Attribute/Browse.php

Mount at line 36–39 requires only browse attributes.
  • Lines 106–122: DeleteBulkAction::make() has NO ->authorize(...) chain (the surrounding per-record delete action at lines 95–104 correctly does ->authorize('delete attributes')).
  • Lines 123–138: BulkAction::make('enabled') has NO ->authorize(...).
  • Lines 139–155: BulkAction::make('disabled') has NO ->authorize(...).
Net effect: a browse attributes-only user can delete every row in the attributes table, and toggle is enabled on every attribute in one request. Deleting an attribute cascades into every product variant that references it via the attribute product pivot.

2) packages/admin/src/Livewire/Pages/Tag/Index.php

Mount at line 39 requires only browse tags.
  • Lines 96–108: DeleteBulkAction::make() has NO ->authorize(...) chain (the per-record delete action at lines 79–94 correctly does ->authorize('delete tags')).
Net effect: a browse tags-only user can delete every ProductTag row.

3) packages/admin/src/Livewire/Pages/Brand/Index.php

Mount at line 37–40 requires only browse brands.
  • Lines 97–112: BulkAction::make('enabled') has NO ->authorize(...).
  • Lines 113–129: BulkAction::make('disabled') has NO ->authorize(...).
Net effect: a browse brands-only user can flip is enabled on every brand. Disabling all brands removes them from the storefront catalog. The per-record edit/delete actions and the DeleteBulkAction at lines 130–148 are correctly ->authorize(...) gated — only the visibility bulk actions were missed.

4) packages/admin/src/Livewire/Pages/Category/Index.php

Mount at line 38–41 requires only browse categories.
  • Lines 102–117: BulkAction::make('enabled') has NO ->authorize(...).
  • Lines 118–133: BulkAction::make('disabled') has NO ->authorize(...).
Net effect: a browse categories-only user can flip is enabled on every category. Same shape as Brand.

5) packages/admin/src/Livewire/Pages/Supplier/Index.php

Mount at line 38 requires only browse suppliers.
  • Lines 93–108: BulkAction::make('enabled') has NO ->authorize(...).
  • Lines 109–125: BulkAction::make('disabled') has NO ->authorize(...).
Net effect: a browse suppliers-only user can flip is enabled on every supplier.

Reference comparison: places that ARE correctly gated

For reference, here is what the same pattern looks like in files that DID get the fix:
  • packages/admin/src/Livewire/Pages/Settings/Currencies.php lines 90–129: every BulkAction chains ->authorize('access setting').
  • packages/admin/src/Livewire/Pages/Reviews/Index.php lines 105–119: DeleteBulkAction chains ->authorize('delete reviews').
  • packages/admin/src/Livewire/Pages/Collection/Index.php lines 109–128: DeleteBulkAction chains ->authorize('delete collections').
  • packages/admin/src/Livewire/Pages/Discount/Index.php lines 126–145: DeleteBulkAction chains ->authorize('delete discounts').
The convention is established and applied elsewhere — these five files just missed it.

Proof of Concept

The attached file tests/Admin/Livewire/Pages/Brand/AuthBypassPocTest.php (added in this report) contains seven Pest tests, each acting as a browse *-only staff user and invoking the bulk endpoint. All seven pass on master @ ac9a760:
  PASS TestsAdminLivewirePagesBrandAuthBypassPocTest
 ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all brands via unguarded BulkAction
 ✓ it SHOPPER-2 PoC: read-only viewer can mass-ENABLE all brands via unguarded BulkAction
 ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all categories via unguarded BulkAction
 ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all suppliers via unguarded BulkAction
 ✓ it SHOPPER-2 PoC: read-only viewer can DELETE all attributes via unguarded DeleteBulkAction
 ✓ it SHOPPER-2 PoC: read-only viewer can mass-DISABLE all attributes via unguarded BulkAction
 ✓ it SHOPPER-2 PoC: browse tags viewer can DELETE all product tags via unguarded DeleteBulkAction

 Tests:  7 passed (32 assertions)
Each test seeds three records, signs in a user holding only the corresponding browse * permission, calls Livewire::test(<Page>::class)->callTableBulkAction(...), and asserts the side effect (records flipped or deleted). For example, the attribute mass-delete test:
php
$this->viewer = User::factory()->create();
$this->viewer->givePermissionTo('browse attributes');
$this->actingAs($this->viewer);

Attribute::factory()->count(3)->create();
expect($this->viewer->can('delete attributes'))->toBeFalse();

Livewire::test(AttributeBrowse::class)
  ->callTableBulkAction(FilamentActionsDeleteBulkAction::class, Attribute::pluck('id')->toArray())
  ->assertHasNoErrors();

expect(Attribute::count())->toBe(0);
The call uses the same callTableBulkAction helper Shopper's own test suite uses everywhere, which in turn drives the same Livewire update payload the browser would emit — so this is a faithful HTTP-level reproduction.

Suggested fix

Add ->authorize(<correct permission>) to each of the five vulnerable groups, mirroring the pattern already used elsewhere:
diff
 // Pages/Attribute/Browse.php
 ->groupedBulkActions([
   DeleteBulkAction::make()
+    ->authorize('delete attributes')
     ->label( ('shopper::forms.actions.delete'))
     ->requiresConfirmation()
     ->action(function (Collection $records): void { /* ... */ }),
   BulkAction::make('enabled')
+    ->authorize('edit attributes')
     ->label( ('shopper::forms.actions.enable'))
     ->action(function (Collection $records): void { /* ... */ }),
   BulkAction::make('disabled')
+    ->authorize('edit attributes')
     ->label( ('shopper::forms.actions.disable'))
     ->action(function (Collection $records): void { /* ... */ }),
 ])
Apply the equivalent change to Pages/Tag/Index.php (delete tags), Pages/Brand/Index.php (edit brands for enable/disable), Pages/Category/Index.php (edit categories), and Pages/Supplier/Index.php (edit suppliers).
A regression test for each file (acting as a browse *-only user and expecting assertHasErrors/AuthorizationException) would lock in the fix, matching the regression tests added for #514.

Resources

  • Prior advisories of the same class (read-only permission gating a write action): GHSA-f946-9qp6-vgch, GHSA-j328-xmgp-j4q3 / GHSA-vw82-3966-f9mr.
  • Same-shape fix: commit ac9a760 (PR #514). Five Filament bulk-action groups did not receive the corresponding ->authorize(...) chain.
  • CWE-285 Improper Authorization, CWE-862 Missing Authorization.

Credits

Reported by Vishal Shukla(@shukla304) using sechub.dev AI Agent

Support

If this disclosure was useful and userswould like to support continued open-source security research and responsible-disclosure work, they can sponsor at https://github.com/sponsors/therawdev — Shopper is thankful for those keeping open source safe.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-56827
GHSA-243P-F3CV-C5WH

Affected Products

Shopper/Framework