CVE-2026-62989 — Shopper: missing variant-delete authorization permits destructive single and bulk actions

Shopper lacks proper authorization for variant-delete actions, permitting destructive single and bulk actions.