Issue with access to placed and received orders

Hi,

I am testing the placed and received orders, and I realized that if I am a vendor that has received orders, but has also placed orders, I can see the same order in both menus. Explanation:

Steps to reproduce

Being yourself a vendor, place an order from some other vendor. Let’s say the order gets number 111

Actual result

Order is placed. Normally the URL to see this order would be …my-account/view-order/111/ . This works.
Strange issue is that I can also view this order with /account/vendor/orders/111/ (when I manually insert the order number in the url)

Expected result

Only …my-account/view-order/111/ should display this order, as it is a placed order

Extra details

The general overviews work correctly:
…account/vendor/orders/ shows only received orders ->good
…my-account/my-orders/ shows only placed orders ->good

I think there are no consequences that could compromise orders, but I think this should be corrected.

Thanks!

Hi,

We checked this issue from our side, and it seems okay. After we created the order, we manually entered the URL, and it redirected to the home page. Please make sure that the user you are testing this with does not have administrator access.