AIKIDO-2026-548461

TL;DR

Spree::ReturnItem validated that an inventory unit belonged to the same customer order as the return item itself, but never checked that the paired return_authorization also belonged to that same order. A flow that pairs a return_authorization with an unrelated order's inventory unit could cancel or alter another customer's return. The fix adds a belongs_to_return_authorization_order validation that rejects mismatched order ids whenever the inventory unit or return authorization changes.