GHSA-h4mp-g9c6-xwph
Shopper: Missing authorization on Product admin Livewire sub-form components
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | shopper/framework | < 2.8.0 | 2.8.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
## Impact
Sub-form Livewire components used in the product editor (`Edit`, `Inventory`, `Seo`, `Shipping`, `Files`) had no authorization on their `store()` method. Any authenticated panel user, regardless of role, could mutate any product's pricing, stock, SEO metadata, shipping dimensions, and attached media without holding `edit_products`.
The affected components accepted the product ID as a public Livewire property without `#[Locked]`, so an attacker could also target an arbitrary product by tampering with the wire payload from the client.
## Patches
Fixed in `v2.8.0`. Each sub-form `store()` now authorizes against `edit_products` and the product binding is locked.
Upgrade via:
```bash
composer require shopper/admin:^2.8
```
## Workarounds
None. Upgrade to `v2.8.0`.
## References
- Pull request: https://github.com/shopperlabs/shopper/pull/511
- CWE-862 Missing Authorization
References
External links from the advisory. They lead to third-party sites.