It depends what the fix was. If the fix was just to add a validation check to the POST endpoint to validate that the logged in user session matched the payload

It depends what the fix was. If the fix was just to add a validation check to the POST endpoint to validate that the logged in user session matched the payload (and session data was comprehensively logged/stored), this may be verifiable. There are obviously lots hypotheticals for which this might not be verifiable.