CVE-2026-62989: Shopper: missing variant-delete authorization permits destructive single and bulk actions

Published Oct 30, 2026

Updated

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with editproducts can access /shopper/products/{id}/edit and obtain the signed component state even without deleteproductvariants. The callTableAction and callTableBulkAction paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.

Event History

Oct 30, 2026

CVE Published

via MITRE·09:03 PM

Data Sourced

via MITRE·09:03 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated staff user who has the edit_products permission can exploit it, even if they do not have the dedicated delete_product_variants permission. They must be able to access the product edit page for the affected product.

Are installations affected by default?

The issue affects Shopper versions prior to 2.10.0 when a staff user is granted edit_products but is not intended to be allowed to delete product variants. The vulnerable delete actions are reachable through the Variants component from the product edit page.

What can an unauthorized user delete?

They can permanently delete a single variant or multiple variants through the component's individual and bulk action paths. For variant products, this can remove sellable catalogue entries and disrupt storefront product pages, carts, and checkout.

What should be done if upgrading is not immediately possible?

Restrict edit_products access to staff who are also trusted to delete product variants, and limit access to product edit pages for variant products. Upgrade to Shopper 2.10.0 to apply the fix.

CVE-2026-62989: Shopper: missing variant-delete authorization permits destructive single and bulk actions

Event History

Frequently Asked Questions

Which users can exploit this issue?

Are installations affected by default?

What can an unauthorized user delete?

What should be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Are installations affected by default?

What can an unauthorized user delete?

What should be done if upgrading is not immediately possible?