CVE-2026-62989
Shopper: missing variant-delete authorization permits destructive single and bulk actions
- Published
- Oct 30, 2026
- Updated
- Oct 30, 2026
- Assigning CNA
- GitHub_M
- Evidence observed
- Aug 29, 2026
Primary CVSS
cvelist · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HSummary
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.
Sources
PoCs & write-ups for CVEs I reported (coordinated disclosure; published + patched only)
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.