CVE-2026-56831

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

• CWE-20

• https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41
• https://github.com/shopperlabs/shopper/pull/528
• https://github.com/shopperlabs/shopper/releases/tag/v2.9.0
• https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf
• https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf

Published

Sep 15, 2026

Last Modified

Sep 16, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-56823AutoGPT is a workflow automation platform for creating, depl…5.4
• CVE-2026-56825Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2…8.1
• CVE-2026-56827Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2…8.1
• CVE-2026-56829Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2…8.1
• CVE-2026-5683A vulnerability was found in Tenda CX12L 16.03.53.12. Affect…8
• CVE-2026-56830Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2…6.5
• CVE-2026-56839PraisonAI is a multi-agent teams system. Prior to 4.6.59, th…7.3
• CVE-2026-5684A vulnerability was determined in Tenda CX12L 16.03.53.12. A…8
• CVE-2026-56841A malicious actor with access to the network and low privile…8.8
• CVE-2026-56842A malicious actor with access to the network and under certa…7.5
• CVE-2026-56843Incorrect authorization in the XML-RPC API of WebPros Plesk …9.9
• CVE-2026-56844A vulnerability in the Veeam Updater component of the Veeam …8.4