-
High 11 Sep 2026
Shopper: Missing authorization on product removal actions in CollectionProducts component
Fixed in 2.9.2 · CVE-2026-56825
-
Medium 11 Sep 2026
Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)
Fixed in 2.9.2 · CVE-2026-56830
-
High 11 Sep 2026
Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component
Fixed in 2.9.2 · CVE-2026-56829
-
High 11 Sep 2026
Shopper: privilege escalation via improper Livewire admin component authorization
Fixed in 2.9.2 · CVE-2026-56828
-
Medium 11 Sep 2026
Shopping privilege escalation through missing authorization in Settings components
Fixed in 2.9.2 · CVE-2026-56826
-
Medium 11 Sep 2026
Shopper: Negative discount values accepted and propagated through order calculation pipeline
Fixed in 2.9.0 · CVE-2026-56831
-
High 11 Sep 2026
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Fixed in 2.9.2 · CVE-2026-56827
Check your project in one command
Composer compares your composer.lock with the public advisory databases:
composer auditIt lists every installed package with a known advisory, including shopper/framework, and the version that fixes it.