TYPO3 Shop by coding.ms 6.2.0 Unauthenticated Order Cancellation

TYPO3 Shop by coding.ms versions before 4.9.4, 5.0.0 through 5.21.0, and 6.0.0 through 6.2.0 contain missing authorization in cancelAction, allowing an unauthenticated visitor to cancel a prepared order by supplying its UID. https://packetstorm.news/download/236753...