Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure

Magento's checkout module allows attackers to access other customers' sensitive information by manipulating order references. This happens because the system doesn't properly verify who should see which data.

Unauthenticated or authenticated attackers can exploit IDOR in the checkout module by directly referencing object identifiers (order IDs, customer data) without proper authorization checks. Exploitation requires knowledge of valid object identifiers and results in unauthorized access to sensitive checkout-related information including customer details and order data.