Authorization Bypass in Shopper Headless E-Commerce Admin Panel

CVE-2026-62989

What is CVE-2026-62989?

The Variants Livewire component in Shopper's Headless E-commerce Admin Panel prior to version 2.10.0 has a significant vulnerability where the DeleteAction and DeleteBulkAction are exposed without sufficient server-side authorization checks. An authenticated user with product editing capabilities can access the editing path for products, allowing them to retrieve the signed component state without having the required delete permissions. This oversight can lead to unauthorized deletion of product variants, severely impacting the sellable inventory and disrupting key functionalities across storefront product displays, cart operations, and the checkout process. This issue has been addressed in version 2.10.0.

References