GHSA-jx83-gwwg-84gf: 
PHP vulnerability analysis and mitigation

PaymentSourcesController::actionDelete() normally restricts deletion to the payment source’s owner. It bypasses that ownership check for any identity with the broad commerce-manageOrders permission. Commerce separately defines commerce-editOrders, commerce-deleteOrders, commerce-capturePayment, and commerce-refundPayment under that permission, so the parent permission alone represents a materially less-trusted order management role. The endpoint accepts an integer payment source ID, loads it without customer scoping, and treats commerce-manageOrders as sufficient to delete it. It then calls the gateway adapter’s deletePaymentSource() with the victim’s token before removing the local record. A read-only order operator can therefore enumerate IDs and revoke other customers’ vaulted cards or payment mandates at the external processor.

Impact

A read-only order operator can revoke the saved payment credentials of arbitrary customers. Report ID: 1885