GHSA-93v2-gcw2-vfwc: Shopper: missing variant-delete authorization permits destructive single and bulk actions
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with editproducts can access /shopper/products/{id}/edit and obtain the signed component state even without deleteproductvariants. The callTableAction and callTableBulkAction paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Shopperto a version that resolves this vulnerability.Fixed in 2.10.0
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated staff user who has the edit_products permission can exploit it, even if they have not been granted delete_product_variants. They must be able to access the product edit route for the target product.
What actions can an attacker perform?
The affected component permits permanent deletion of either individual variants or multiple variants through its table action and bulk-action paths. This can remove a variant product's sellable catalogue and disrupt associated storefront pages, carts, and checkout.
Are deployments fixed by upgrading to a particular release?
Yes. The issue is fixed in Shopper version 2.10.0; versions prior to 2.10.0 are affected according to the advisory.
What can be done if an immediate upgrade is not possible?
Restrict edit_products to only staff who should also be trusted to delete product variants. The vulnerability allows users with edit_products to bypass the separate delete_product_variants authorization check.