GHSA-243p-f3cv-c5wh: Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers

A security flaw in Shopper's admin interface allows staff members with read-only browse permissions to perform destructive bulk actions they shouldn't be able to do. Specifically, five admin pages are missing authorization checks (->authorize(...) permission gates) on their bulk action features, letting browse-only staff delete all attributes and tags, or disable all brands, categories, and suppliers. This is a type of authorization bypass (CWE-862, missing authorization) with a CVSS severity score of 8.1 High.