Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization (CVE-2026-56830) | HOL Guard CVE

Medium · CVSS 6.5CVE-2026-56830GHSA-99H5-JHH7-V3R3

Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization

Answer in brief

CVE-2026-56830 records a Medium severity (CVSS 6.5) vulnerability in Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization. The current sources do not mark it as known exploited. The current feed maps shopper/framework (composer), shopperlabs/shopper (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Sep 15, 2026Updated Sep 15, 2026Source checked Sep 15, 2026First seen by HOL Sep 11, 2026Material review Sep 15, 2026

Upstream Advisory

Key facts

Risk: Medium · CVSS 6.5
Exploitation: Not marked as known exploited
Affected software: 2 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 6.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps shopper/framework (composer), shopperlabs/shopper (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
shopper/frameworkcomposer	<2.9.2	2.9.2
shopperlabs/shoppergeneric	< 2.9.2	Not reported

Recommended response

Check inventory. Check lockfiles and deployed manifests for shopper/framework, shopperlabs/shopper.
Review the reported fix. Update shopper/framework to 2.9.2 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Sep 11, 2026

Sources and claim methodology

Upstream source description

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Components/Products/Form/Media.php without the edit_products authorization check used by sibling sub-forms. An authenticated staff user with browse_products can invoke the Livewire store action and replace the thumbnail and gallery images for a product whose Media component was initialized, even without product-edit permission. The product binding is locked, so the attacker cannot redirect the update to an arbitrary product through client-side ID substitution, and the impact is limited to products whose edit pages were loaded. This issue is fixed in version 2.9.2.

Quoted source text, attributed separately from HOL analysis.