Customer can cancel a individual booking in a batch, causing locking of partner.

Summary

A logic flaw allowed users to update the status of individual trips inside a batch, even though only batch-level status changes were intended. By cancelling the single trip inside a one-parcel batch, an attacker could place the batch into an inconsistent state, causing the assigned partner to get stuck in a booking they could not complete or cancel.