Threats Tagged 'cve-2026-56826'

A privilege escalation vulnerability exists in the Shopper Framework's Settings area where four Livewire components allow authenticated users with only the coarse 'access_setting' permission to perform destructive delete actions without proper server-side authorization. This flaw enables deletion of tax zones, tax rates, shipping zones, and carrier options, which are critical for checkout processes. The affected components lack per-resource permission checks, allowing low-privileged users to delete these records directly via Livewire endpoints. This breaks shipping-rate calculations, removes region-scoped payment methods, and corrupts tax resolution at checkout. The issue affects versions >=2.0.0 and <2.9.2 and has a CVSS score of 5.4 (medium severity). A patch is available.