GHSA-r2vg-hvjm-fg38: Shopware Customer Orders can be canceled, even if refunds are disabled

The vulnerability description clearly states that a customer can cancel an order via a custom-crafted request, bypassing the UI, because the check for the core.cart.enableOrderRefunds setting is missing in the backend route. The provided commit patch b157508aef2c820e7ff89ebd5848d3019f22b592 directly addresses this issue. The analysis of the patch shows that the cancel method within src/Core/Checkout/Order/SalesChannel/CancelOrderRoute.php is modified to include the missing authorization check. This route corresponds to the store-api.order.state.cancel endpoint, which can be called directly, bypassing any frontend logic in controllers like AccountOrderController. Therefore, the Shopware\Core\Checkout\Order\SalesChannel\CancelOrderRoute::cancel function is the exact location of the vulnerability, as it's the entry point for the unauthorized action. The patch adds the necessary validation, confirming this was the vulnerable function.