Broken Access Control vulnerability when editing Commerce Order private notes
What changed: Order note edit operations now verify the permission scope of the requesting user against the specific note before allowing an edit.
Why: An Order Administrator role with restricted access to private notes could change the note ID parameter to edit the private notes of another administrator. This exposed content that should have stayed restricted. This is a Broken Access Control issue.
Who is affected: Commerce deployments that use restricted Order Administrator roles together with private order notes.
How to update: Apply the patched release. Private notes can no longer be edited by roles without explicit permission, whatever note ID is used in the request.