[PRODSECBUG-2162] Unauthorized data control due to a bypass of authentication controls for a customer using a web API endpoint

An authenticated customer could control other customer’s requistion lists by using a web API endpoint to send a request to the server. (This overrides the customer_id parameter.)

Part of update Magento 2.3.1, 2.2.8 and 2.1.17 Security Update

This vulnerability affects the following application versions:

• Magento 2.2.6
• Magento 2.2.7
• Magento 2.3.0