# CVE-2026-56831

## Summary

- **CVE ID:** CVE-2026-56831
- **Severity:** MEDIUM
- **CVSS Score:** 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
- **CWE:** CWE-20
- **Published:** Sep 15, 2026
- **Last Modified:** Sep 16, 2026

## Description

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.0, the /cpanel/discounts administrative interface accepts negative fixed_amount discount values, persists them in sh_discounts, and passes them through vendor/shopper/cart/src/Discounts/DiscountCalculator.php and vendor/shopper/cart/src/Pipelines/Calculate.php without enforcing a positive-value invariant. Because the calculation subtracts discountTotal from the subtotal, a negative discount increases the resulting order total instead of reducing it. Malformed discount records can therefore cause incorrect pricing and financial data integrity failures, although the advisory does not establish a customer-facing exploitation path. This issue is fixed in version 2.9.0.

## Affected Products

- shopperlabs — shopper (< 2.9.0)

## References

- [CNA](https://github.com/shopperlabs/shopper/security/advisories/GHSA-5vf4-452p-jjhf)
- [CNA](https://github.com/shopperlabs/shopper/pull/528)
- [CNA](https://github.com/shopperlabs/shopper/commit/967e616281ded1a0050d9102858ecd7dd7f66a41)
- [CNA](https://github.com/shopperlabs/shopper/releases/tag/v2.9.0)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.41%
- **EPSS Percentile:** 34.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._