Shopper: Missing authorization for variant deletion in admin panel
Summary
Shopper is a headless e-commerce admin panel. Before version 2.10.0, the Variants Livewire component exposes single and bulk delete actions without server-side permission checks for delete_product_variants. An authenticated staff user with edit_products can permanently delete product variants, which can destroy the sellable catalogue and disrupt storefront product pages, cart and checkout.
Affected
- Shopper versions before 2.10.0
- Affected component: Variants Livewire component (product edit form)
Fixed in
- Fixed in Shopper 2.10.0
- Later releases such as 2.10.1 are also available; use the latest 2.x release that is tested for your installation
Workaround
Unknown. No vendor workaround is documented. Interim measure: remove edit_products from users who do not need it and review who holds delete_product_variants.
Exploitation
- Not known to be exploited in the wild
- CISA KEV: not listed
- No public proof of concept found; this does not exclude that one exists
- EPSS: 0.28 % (percentile 20)
Our recommendation
- Upgrade Shopper to 2.10.0 or a later tested 2.x release
- Review which staff roles hold edit_products and delete_product_variants and remove unnecessary access
- Restrict the admin panel to the internal network or VPN where possible
- Back up the database before upgrading and check product variants for missing entries
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-93v2-gcw2-vfwc github.com
- Fix commit 3c814f3 github.com
- Pull Request #573 github.com
- Shopper release v2.10.0 github.com
- VulDB CVE-2026-62989 vuldb.com
- Strix CVE-2026-62989 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:45.
Original description (NVD)
Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.