Commerce bug or mis-configuration?

Development
1

Not sure if I should post possible bugs or issues here? I have the same message on Slack, which has no replies yet, so thought I would post here too… please let me know if I should only post there, or here, and I shall do that in the future. The message is as follows:

I am just experimenting with Commerce and I have a problem with guest cart shopping experience which I think may be a bug. Currently running DXP 26 Q1, I believe it is there in version Portal 7.4.3.132 as well.

The problem occurs when displaying product information in fragments rather than using widgets.

From a minimally configured (just enough to add a product to a page) docker container:

  • When logged in
    • Page One
      • Add a page with a Collection Display with the collection being Commerce Products
      • Add a Product card to the the collection display
      • The Collection Display shows the product - all good
    • Page Two
      • Add a second page with a Product Publisher widget
      • Product Publisher shows the product - all good
  • When logged out and viewing the pages above
    • Page One

      • Get an exception:

        2026-04-07 00:48:39.848 ERROR [http-nio-8080-exec-5][IncludeTag:119] Current URL /web/test-site/test generates exception: jakarta.servlet.jsp.JspException: java.lang.RuntimeException: Unable to get collection info page for object definition 32539com.liferay.portal.kernel.security.auth.PrincipalException$MustHavePermission: User 20099 must have VIEW permission for com.liferay.commerce.product.model.CommerceCatalog 37887

      • No content is shown, including that from any other fragments which might be on the page.

    • Page Two
      • All good, product is still shown.

So there seems to be a difference in behavior or permission checks for the commerce widget and fragment. I have tried checking and changing lots of permissions, played with the guest roll, but all to no avail… still get the exception. It might be that something is not configured correctly for the guest user to view the commerce fragments, but the funny thing is it works for the widget, so I am thinking there might be something else going on? Perhaps a bug?

2

This issue seems to remain also in DXP 2026.q2.

With this bug (I believe it is), you can’t use the product fragments (e.g. a Product Card) if you want to have your shopping site able to be viewed by a guest user. It seems a fairly significant issue (especially since none of the other content on the page then shows), though there is a work around I guess, and that is to use the widgets instead of the fragments.

Also just posting in a reply here that was made on the Slack site before the Slack site goes away.

The reply was from Isaac Wilson:

Hello C F, thanks for reaching out! I’m not sure whether or not this is a bug (I see that you also opened a thread here on Discuss, so hopefully a commerce product team member sees the thread and can chime in!).

But, based on the errors I would guess that the Guest user needs additional permissions to allow viewing a catalog’s or collection’s products.

As a potential troubleshooting step, could you try:

  1. As an admin, navigating to the Global Menu > Control Panel > Roles

  2. Clicking on the Guest role to edit it

  3. On the Define Permissions tab, adding the following permissions:

    1. Catalog Permissions: Commerce > Product Management > Catalogs > Resource Permissions > Catalogs > View Commerce Catalogs

    2. Object Permissions: This path will depend slightly on how you’ve configured the object’s Scope/Panel Link, but it will look something like this (for something configured at the Site scope with a Content & Data panel link):

      1. Site and Asset Library Administration > Content & Data > [Object Name] > Resource Permissions > [Object Name] > View

I replied as follows:

Thanks for your reply. The funny thing is that the product widget (rather than the fragment) shows the content fine, so one would assume the permissions are correct, or that it has a bug and shouldn’t show the product either.

I have previously updated the Catalog Permissions, as you mentioned, but it had no impact. But I have not done the Object Permissions part, and am a little unsure on how to find the settings you mentioned. I have not configured the “object’s Scope/Panel Link”, maybe I should have? Basically it is a configuration pretty much from the docker image with the new CMS/Spaces enabled, and just enough commerce config to get the product on the page.

Having trouble finding the Site and Asset Library Administration configuration.