1 matches found
Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers
Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...
8.1CVSS6.1AI score0.00504EPSS
SaveExploits0References2Affected Software1
20