An authorization bypass exists in the Order and OrderItem REST API controllers. A remote, authenticated user can read, modify, and delete orders and order items belonging to other companies (tenants) by providing a sequential numeric `id` to the following endpoints:
- 'GET /api/order/{id}'
- 'PUT /api/order/{id}'
- 'GET /api/order-item/{id}'
- 'PUT /api/order-item/{id}'
- 'DELETE /api/order-item/{id}'
This occurs because the controllers use the `Order::find($id)` and `Item::find($id)` functions to resolve records without restricting the search to the authenticated user's company.