Summary
Shopper: Negative discount values accepted and propagated through order calculation pipeline
The Shopper Framework discount management functionality accepts negative discount values without server-side validation.
It was confirmed that negative fixed-amount discounts can be created through the administrative interface, persisted to the database, and subsequently processed by the cart/order calculation pipeline.
The application appears to assume that discount values are always positive but does not enforce this assumption during creation, storage, or calculation.
As a result, malformed discount records can influence financial calculations and produce unintended order totals.
Affected Product
Package: shopper/framework
Version Tested: 2.8.1
Vulnerability Type
- Business Logic Vulnerability
- Improper Input Validation (CWE-20)
Description
While reviewing the discount functionality, it was discovered that the application accepts negative discount values through the administrative interface.
Example values tested:
-50.00
-99,999,999.00
The application accepted these values without validation and stored them in the database.
Example records observed in the sh_discounts table:
1 | QCZ5Y3HESM | fixed_amount | -5000
4 | TOZKAHCB4S | fixed_amount | -9999999900
This demonstrates that negative discount values are successfully persisted.
Steps to Reproduce
1. Create a Discount
Login as an administrator.
Navigate to:
/cpanel/discounts
Create a new discount with the following values:
Type: fixed_amount
Value: -99999999
Save the discount.
2. Observe Successful Creation
The discount is accepted by the application and displayed in the administration interface.
Example:
Code: TOZKAHCB4S
Amount: -$99,999,999.00
3. Verify Database Persistence
Inspect the database:
select * from sh_discounts;
Observed entry:
TOZKAHCB4S | fixed_amount | -9999999900
Technical Analysis
Discount Calculation
File:
vendor/shopper/cart/src/Discounts/DiscountCalculator.php
Observed code:
$fixedAmount = $discount->value;
The value is later processed without validation:
$fixedAmount = min($fixedAmount, $applicableSubtotal);
When a negative value is supplied:
min(-9999999900, 10000)
returns:
-9999999900
allowing the negative value to continue through the calculation pipeline.
The resulting adjustment values are inserted into the database:
CartLineAdjustment::query()->insert($adjustments);
No validation was identified to ensure that discount amounts are positive before calculations occur.
Final Total Calculation
File:
vendor/shopper/cart/src/Pipelines/Calculate.php
Observed logic:
$context->total = max(
0,
$context->taxInclusive
? $context->subtotal - $context->discountTotal
: $context->subtotal - $context->discountTotal + $context->taxTotal
);
Because negative discount values are allowed to reach this stage, financial calculations are performed using malformed discount data.
Example:
Subtotal = 10000
DiscountTotal = -5000
Resulting calculation:
10000 - (-5000)
Result:
15000
This demonstrates that negative discount values directly affect order total calculations.
Fixed Amount Discounts
value > 0
Percentage Discounts
0 < value <= 100
Additionally, existing discount records should be validated before calculation to prevent malformed data from influencing pricing logic.
Environment
Shopper Framework 2.8.1
Laravel 12.61.1
PHP 8.4.16
SQLite
Impact
The following was confirmed:
- Negative discount values are accepted.
- Negative discount values are persisted.
- Negative discount values are processed by the discount calculation engine.
- Negative discount values affect order total calculations.
Potential consequences include:
- Incorrect pricing calculations.
- Financial data integrity issues.
- Unexpected order totals.
- Violated assumptions within downstream pricing logic.
- Future vulnerabilities if additional components assume discount values are always positive.
Because Shopper is a headless e-commerce administration framework and does not ship with a customer-facing storefront, it was not verified a customer-facing exploitation path.
However, malformed discount records currently propagate through pricing calculations without validation.
The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.
CVE-2026-56831 has a CVSS score of 6.5 (Medium). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.9.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Implement server-side validation enforcing positive discount values before persistence and before entering the calculation pipeline.
Suggested validation:
Frequently Asked Questions
- What is CVE-2026-56831? CVE-2026-56831 is a medium-severity improper input validation vulnerability in shopper/framework (composer), affecting versions < 2.9.0. It is fixed in 2.9.0. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
- How severe is CVE-2026-56831? CVE-2026-56831 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of shopper/framework are affected by CVE-2026-56831? shopper/framework (composer) versions < 2.9.0 is affected.
- Is there a fix for CVE-2026-56831? Yes. CVE-2026-56831 is fixed in 2.9.0. Upgrade to this version or later.
- Is CVE-2026-56831 exploitable, and should I be worried? Whether CVE-2026-56831 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-56831 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-56831? Upgrade
shopper/frameworkto 2.9.0 or later.