GHSA-fxqw-97cc-7g5c Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables

• Packagist shopper/framework: < 2.8.0 → fixed in 2.8.0

Impact The admin tables for `PaymentMethods`, `Currencies` and `Carriers` exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user without checking the corresponding per-action permission. A low-privilege user could: • Disable every payment method on the store, blocking checkout. • Disable or alter the default currency, changing displayed prices and the exchange rate basis. • Disable carriers, breaking shipping rate computation at checkout. The impact is a full denial of checkout and pricing integrity loss, reachable by any authenticated user. Patches Fixed in `v2.8.0`. Each toggle and per-record action now requires its matching permission (`edit_payment_methods`, `edit_currencies`, `edit_carriers`). Upgrade via: ```bash composer require shopper/admin:^2.8 ``` Workarounds None. Upgrade to `v2.8.0`.