THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-99h5-jhh7-v3r3 (medium) — Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

[GHSA] GHSA-99h5-jhh7-v3r3 (medium) — Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

highgithub_advisoriesPublished 2026-09-11

GHSA-99h5-jhh7-v3r3 Severity: medium CVE: CVE-2026-56830

Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

## Title

Missing authorization on Media sub-form store action allows unpermissioned product media update

## Description

A lack of authorization control on the `store()` method was found in `packages/admin/src/Livewire/Components/Products/F

Indicators of compromise

CVE-2026-56830cve
media.storedomain

Original source: https://github.com/advisories/GHSA-99h5-jhh7-v3r3