[HIGH] Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

PKSA-wj51-ggrn-qn6q CVE-2026-56827 GHSA-243p-f3cv-c5wh

Affected package: shopper/framework

Affected version: <2.9.2

Reported by:
GitHub