CyberRota Analysis
AI-GeneratedThe vulnerability affects the Shopper Headless e-commerce Admin Panel prior to version 2.9.2, where the stockAction() function is exposed without proper authorization checks, allowing authenticated users with minimal permissions to manipulate product inventory. This can lead to unauthorized stock adjustments, enabling users to inflate or deplete inventory levels at will. E-commerce platforms using affected versions should prioritize this update to mitigate potential inventory fraud and maintain system integrity.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. This issue is fixed in version 2.9.2.