diff --git a/vendor/magento/module-company/Model/SaveValidator/SanitizeRegion.php b/vendor/magento/module-company/Model/SaveValidator/SanitizeRegion.php
new file mode 100644
index 000000000000..4592ab614d06
--- /dev/null
+++ b/vendor/magento/module-company/Model/SaveValidator/SanitizeRegion.php
@@ -0,0 +1,53 @@
+<?php
+/**
+ * ADOBE CONFIDENTIAL
+ *
+ * Copyright 2026 Adobe
+ * All Rights Reserved.
+ *
+ * NOTICE: All information contained herein is, and remains
+ * the property of Adobe and its suppliers, if any. The intellectual
+ * and technical concepts contained herein are proprietary to Adobe
+ * and its suppliers and are protected by all applicable intellectual
+ * property laws, including trade secret and copyright laws.
+ * Dissemination of this information or reproduction of this material
+ * is strictly forbidden unless prior written permission is obtained
+ * from Adobe.
+ */
+declare(strict_types=1);
+
+namespace Magento\Company\Model\SaveValidator;
+
+use Magento\Company\Api\Data\CompanyInterface;
+use Magento\Company\Model\SaveValidatorInterface;
+use Magento\Framework\Filter\StripTags;
+
+/**
+ * Sanitizes the company region value.
+ */
+class SanitizeRegion implements SaveValidatorInterface
+{
+    /**
+     * @param CompanyInterface $company
+     * @param StripTags $stripTags
+     */
+    public function __construct(
+        private readonly CompanyInterface $company,
+        private readonly StripTags $stripTags
+    ) {
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public function execute()
+    {
+        $region = $this->company->getRegion();
+        if (empty($region)) {
+            return;
+        }
+
+        $sanitized = trim($this->stripTags->filter($region));
+        $this->company->setRegion($sanitized);
+    }
+}
diff --git a/vendor/magento/module-company/etc/di.xml b/vendor/magento/module-company/etc/di.xml
index cf9fe0d45f54..e14ea26d4fce 100755
--- a/vendor/magento/module-company/etc/di.xml
+++ b/vendor/magento/module-company/etc/di.xml
@@ -33,6 +33,7 @@
                 <item name="companyId" xsi:type="string">\Magento\Company\Model\SaveValidator\CompanyId</item>
                 <item name="requiredFields" xsi:type="string">\Magento\Company\Model\SaveValidator\RequiredFields</item>
                 <item name="companyName" xsi:type="string">\Magento\Company\Model\SaveValidator\SanitizeCompanyName</item>
+                <item name="companyRegion" xsi:type="string">\Magento\Company\Model\SaveValidator\SanitizeRegion</item>
                 <item name="salesRepresentative" xsi:type="string">\Magento\Company\Model\SaveValidator\SalesRepresentative</item>
                 <item name="customerGroup" xsi:type="string">\Magento\Company\Model\SaveValidator\CustomerGroup</item>
                 <item name="companyStatus" xsi:type="string">\Magento\Company\Model\SaveValidator\CompanyStatus</item>
diff --git a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php
index 74236b6814a1..279efc076f11 100644
--- a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php
+++ b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ApproveRejectPurchaseOrderPlugin.php
@@ -12,2 +12,3 @@
 use Magento\Company\Model\CompanyContext;
+use Magento\Company\Api\CompanyManagementInterface;
 use Magento\Company\Model\UserRole;
@@ -20,9 +21,11 @@
 use Magento\PurchaseOrderRule\Api\AppliedRuleRepositoryInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleApproverInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleInterface;
+use Magento\Framework\App\ObjectManager;
 
 /**
  * Plugin to restrict action to remaining rule approvers and company admin
+ *
  */
 class ApproveRejectPurchaseOrderPlugin
 {
@@ -61,6 +64,11 @@ class ApproveRejectPurchaseOrderPlugin
      */
     private $appliedRuleApproverRepository;
 
+    /**
+     * @var CompanyManagementInterface
+     */
+    private $companyManagement;
+
     /**
      * @param CompanyAdminPermission $companyAdminPermission
      * @param CompanyContext $companyContext
@@ -69,6 +77,7 @@ class ApproveRejectPurchaseOrderPlugin
      * @param AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository
      * @param UserRoleManagement $userRoleManagement
      * @param SearchCriteriaBuilder $searchCriteriaBuilder
+     * @param CompanyManagementInterface|null $companyManagement
      */
     public function __construct(
         CompanyAdminPermission $companyAdminPermission,
@@ -77,7 +86,8 @@ public function __construct(
         AppliedRuleRepositoryInterface $appliedRuleRepository,
         AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository,
         UserRoleManagement $userRoleManagement,
-        SearchCriteriaBuilder $searchCriteriaBuilder
+        SearchCriteriaBuilder $searchCriteriaBuilder,
+        ?CompanyManagementInterface $companyManagement = null
     ) {
         $this->companyAdminPermission = $companyAdminPermission;
         $this->companyContext = $companyContext;
@@ -86,6 +96,8 @@ public function __construct(
         $this->appliedRuleApproverRepository = $appliedRuleApproverRepository;
         $this->userRoleManagement = $userRoleManagement;
         $this->searchCriteriaBuilder = $searchCriteriaBuilder;
+        $this->companyManagement = $companyManagement ?:
+            ObjectManager::getInstance()->get(CompanyManagementInterface::class);
     }
 
     /**
@@ -102,6 +114,8 @@ public function __construct(
     {
         if ($this->companyAdminPermission->isGivenUserCompanyAdmin($this->companyContext->getCustomerId()) &&
             $this->companyStructure->getAllowedChildrenIds((int)$this->companyContext->getCustomerId())
+            && (int) $purchaseOrder->getCompanyId() ===
+            (int) $this->companyManagement->getByCustomerId($this->companyContext->getCustomerId())->getId()
         ) {
             return true;
         }
diff --git a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php
index 36e3f220989f..679022c76a56 100644
--- a/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php
+++ b/vendor/magento/module-purchase-order-rule/Plugin/Customer/Authorization/ViewPurchaseOrderPlugin.php
@@ -12,2 +12,3 @@
 use Magento\Company\Model\CompanyContext;
+use Magento\Company\Api\CompanyManagementInterface;
 use Magento\Company\Model\UserRole;
@@ -20,9 +21,11 @@
 use Magento\PurchaseOrderRule\Api\AppliedRuleRepositoryInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleApproverInterface;
 use Magento\PurchaseOrderRule\Api\Data\AppliedRuleInterface;
+use Magento\Framework\App\ObjectManager;
 
 /**
  * Plugin to restrict view to remaining rule approvers and company admin
+ *
  */
 class ViewPurchaseOrderPlugin
 {
@@ -61,6 +64,11 @@ class ViewPurchaseOrderPlugin
      */
     private $appliedRuleApproverRepository;
 
+    /**
+     * @var CompanyManagementInterface
+     */
+    private $companyManagement;
+
     /**
      * @param CompanyAdminPermission $companyAdminPermission
      * @param CompanyContext $companyContext
@@ -69,6 +77,7 @@ class ViewPurchaseOrderPlugin
      * @param AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository
      * @param UserRoleManagement $userRoleManagement
      * @param SearchCriteriaBuilder $searchCriteriaBuilder
+     * @param CompanyManagementInterface|null $companyManagement
      */
     public function __construct(
         CompanyAdminPermission $companyAdminPermission,
@@ -77,7 +86,8 @@ public function __construct(
         AppliedRuleRepositoryInterface $appliedRuleRepository,
         AppliedRuleApproverRepositoryInterface $appliedRuleApproverRepository,
         UserRoleManagement $userRoleManagement,
-        SearchCriteriaBuilder $searchCriteriaBuilder
+        SearchCriteriaBuilder $searchCriteriaBuilder,
+        ?CompanyManagementInterface $companyManagement = null
     ) {
         $this->companyAdminPermission = $companyAdminPermission;
         $this->companyContext = $companyContext;
@@ -86,6 +96,8 @@ public function __construct(
         $this->appliedRuleApproverRepository = $appliedRuleApproverRepository;
         $this->userRoleManagement = $userRoleManagement;
         $this->searchCriteriaBuilder = $searchCriteriaBuilder;
+        $this->companyManagement = $companyManagement ?:
+            ObjectManager::getInstance()->get(CompanyManagementInterface::class);
     }
 
     /**
@@ -105,6 +117,8 @@ public function afterIsAllowed(ViewPurchaseOrder $subject, $result, $purchaseOrd
         }
         if ($this->companyAdminPermission->isGivenUserCompanyAdmin($this->companyContext->getCustomerId()) &&
             $this->companyStructure->getAllowedChildrenIds((int)$this->companyContext->getCustomerId())
+            && (int) $purchaseOrder->getCompanyId() ===
+            (int) $this->companyManagement->getByCustomerId($this->companyContext->getCustomerId())->getId()
         ) {
             return true;
         }