GHSA-wr49-2q4p-354w: 
PHP vulnerability analysis and mitigation

Commerce registers commerce-manageSubscriptions and commerce-manageSubscriptionPlans as independent sibling permissions. The navigation correctly exposes the Subscription Plans section only to users with the latter permission. PlansController, however, authorizes edit, save, and archive operations with commerce-manageSubscriptions instead. This lets an operator who is trusted to administer individual customer subscriptions rewrite billing plan configuration. actionSavePlan() accepts the gateway, external plan reference, display name, handle, linked information entry, and enabled state, then persists them after checking the wrong permission. actionArchivePlan() has the same issue, and actionPlanIndex() and actionReorder() do not require either subscription-specific permission beyond generic Commerce access.

Impact

A user who can manage customer subscription instances can alter the global mapping between Commerce plans and gateway-side billing plans. Pointing a Commerce plan at an unintended external reference, disabling it, or archiving it can enroll customers into the wrong price or billing cadence. Report ID: 1884