Insecure Direct Object Reference vulnerability in Commerce Order Notes Management
What changed: Order note operations now validate that the target order and note belong to the virtual instance of the requesting user. This covers adding, editing, deleting, and listing notes.
Why: A user on one virtual instance could add, edit, delete, or list order notes belonging to another instance by referencing the order or note ID directly. This is an Insecure Direct Object Reference.
Who is affected: Multi-instance Commerce deployments.
How to update: Apply the patched release. Order note operations across instances are now blocked.