TastyIgniter Incorrect Access Control Vulnerability in Orders Management System Allowing Unauthorized Status Updates

An incorrect access control vulnerability has been identified in TastyIgniter version 3.7.6, specifically within the Orders Management System. The issue arises in the 'index_onUpdateStatus()' function of 'Orders.php', where the application fails to properly verify if a user has the necessary permissions to change an order's status. This vulnerability can be exploited remotely, enabling unauthorized users to manipulate order statuses.

Impact

Exploitation of this vulnerability allows for unauthorized modification of order statuses, potentially leading to incorrect order management and processing.