CVE-2023-32065: OroCommerce get-totals-for-checkout API endpoint returns unwanted data

The vulnerability stems from improper access control (CWE-284) in an API endpoint. The pattern suggests a missing authorization check in the controller action responsible for handling checkout totals requests. The endpoint name 'get-totals-for-checkout' maps to a standard Symfony controller action naming convention (getTotalsForCheckoutAction). The vulnerability allows data exposure through Checkout ID enumeration, indicating the handler didn't verify user permissions before returning sensitive checkout totals data. The confidence is high as this pattern matches the described vulnerability and typical Symfony architecture, though without direct code access we rely on standard implementation patterns.