Find the object-authorization flaw in this generated Rails controller.
ruby
class OrdersController < ActionController::API
def update
order = Order.find(params[:id])
order.update!(params.require(:order).permit(:status))
render json: { id: order.id, status: order.status }
end
end