CVE-2026-56831 Shopper: Negative discount values accepted and propagated through order calculation pipeline
Administrators can create negative discounts that incorrectly increase order totals, compromising financial data integrity in the Shopper e-commerce platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56831?
CVE-2026-56831 is a medium-severity vulnerability in shopperlabs shopper, published on 15 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.
Weakness: CWE-20
Which versions are affected by CVE-2026-56831?
2 open source packages ship an affected version, including shopper/framework.
| Package | Affected | Fixed in |
|---|---|---|
shopper/framework Packagist | All versions | 2.9.0 |
shopper/framework Packagist | All versions | 2.9.0 |
How do I fix CVE-2026-56831?
Upgrade shopper/framework to 2.9.0 or later.
Is CVE-2026-56831 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56831 exists.
Sources
Also known as GHSA-5vf4-452p-jjhf.