CVE-2026-62989— Shopper: missing variant-delete authorization permits destructive single and bulk actions

Quick assessment

Affected

shopperlabs shopper

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Shopper 是一个无头电商管理后台。在 2.10.0 版本之前，位于的 Variants Livewire 组件暴露了和，且未实施服务器端授权检查。任何拥有权限的已认证员工用户均可访问页面，并获取已签名的组件状态，即使该用户并不具备权限。随后，通过和路径，系统会在未验证专用权限的情况下，永久删除单个或多个产品变体。对于变体产品而言，此问题可能导致可售商品目录被破坏，并扰乱前端商品页面、购物车及结账流程。该漏洞已在 2.10.0 版本中修复。

CVSS 8.1 · High Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1551

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Shopper: missing variant-delete authorization permits destructive single and bulk actions

Source: CVE Program / CVE List V5

Vulnerability Description

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
shopperlabs	shopper	< 2.10.0	-

II. Public POCs for CVE-2026-62989

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62989

请登录查看更多情报信息。

Other References for CVE-2026-62989 (4)

https://github.com/shopperlabs/shopper/pull/573 x_refsource_MISC
https://github.com/shopperlabs/shopper/releases/tag/v2.10.0 x_refsource_MISC
https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc x_refsource_CONFIRM
https://github.com/shopperlabs/shopper/commit/3c814f3b8eaf7cd2296c213bec0ce91e9f92a3f2 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62989

Same Patch Batch · shopperlabs · 2026-10-30 · 3 CVEs total

CVE-2026-62990	8.7 HIGH	Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator c
CVE-2026-62991	6.5 MEDIUM	Shopper: customer detail IDOR exposes administrator and staff records

IV. Related Vulnerabilities

Same product: shopper

Same vendor: shopperlabs

Same weakness: CWE-285