CVE-2026-56827

Shopper , a headless e-commerce admin panel, contains an authorization bypass in five Filament groupedBulkActions blocks (Attribute, Tag, Brand, Category, Supplier pages) that omit the ->authorize() permission gate while page access requires only read-only browse_* permissions. A browse-only s...

Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

Summary Five Filament groupedBulkActions blocks across the Shopper admin Livewire pages omit the -authorize... permission gate, while their per-record sibling actions and other Shopper Index pages such as Pages/Settings/Currencies.php, Pages/Reviews/Index.php, Pages/Collection/Index.php, and...

DRUPAL-CONTRIB-2024-026

The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes. The module doesn't validate the content of classes. A malicious user with access ...