Multiple Cross-Instance IDORs in Commerce Shipments
What changed: Commerce Shipment operations — editing carrier/tracking details, deleting shipments, and adding/removing products or adjusting stock — now verify the instance scope of the shipment before acting. Why: An administrator on one virtual instance could edit or delete shipments, and manipulate their products and stock, on another instance by changing the shipment ID in the request — multiple cross-instance IDORs (LSV-1639). Who is affected: Multi-instance Commerce deployments. How to update: Apply the patched release; shipment operations are now restricted to the user’s own instance.