Insecure Direct Object Reference vulnerability in Commerce Measurement Units
What changed: The Commerce Measurement Unit service now validates the instance (company) scope of the targeted record before allowing an update.
Why: An administrator on a secondary virtual instance could edit Measurement Units on the default instance by altering the measurement unit ID in the request. This is an Insecure Direct Object Reference.
Who is affected: Multi-instance Commerce deployments.
How to update: Apply the patched release. Cross-instance Measurement Unit edits are no longer possible, so confirm that any automation operates within the correct instance.