TL;DR
🔒 This is a security release!
Fixes the following vulnerabilities:
- Percent-encoded API path bypasses shop API ownership filters, exposing and modifying other customers' data
- A disabled API stays reachable through a percent-encoded path
- Host header injection in the shop password reset e-mail link when the channel has no hostname
- Unpublished product reviews disclosed through the Shop API item endpoint
- Channel-based payment method restriction bypass on shop payment request API endpoint
What's Changed
- [PaymentBundle] Return the latest payment request when several match the action, payment and method by @GSadee in #19302
Full Changelog: v2.2.11...v2.2.12