Shopper: Missing authorization on product removal actions in CollectionProducts component

Title Missing authorization on product removal actions in CollectionProducts component Description A lack of authorization control was discovered on both the per-record delete action and the bulk delete action inside packages/admin/src/Livewire/Components/Collection/CollectionProducts.php. Neithe...

PT-2026-90541

Name of the Vulnerable Software and Affected Versions Shopper versions prior to 2.9.2 Description An authorization bypass exists in the packages/admin/src/Livewire/Components/Collection/CollectionProducts.php component. The Action::make'delete' and DeleteBulkAction::make functions lack proper...