The Drupal Security Team rates this Highly critical (21/25). Commerce Core does not sufficiently protect certain routes and entity fields, which allows an access bypass that "may financially impact the vendor." The advisory states that the flaw is being actively exploited in the wild. No authentication or special conditions are listed as required.

• Affected: Commerce Core below 8.x-2.41, and 3.x below 3.3.13.
• Fixed: 3.3.13 (3.x) and 8.x-2.41 (2.x).

What to do: update now. Because exploitation is confirmed, the Drupal team tells sites to audit orders for inconsistencies, such as prices, totals, payment states or order states that do not match what customers paid. Compare order totals with your payment provider's settlement records for the period before you patched.