CVE-2026-62991 Shopper: customer detail IDOR exposes administrator and staff records

Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route /cpanel/customers/user/show in packages/admin/src/Livewire/Pages/Customers/Show.php checks readcustomers but looks up an arbitrary user ID without applying the customers role scope used by the listing...