Skip to content
Back to Blog
fvewebauthenticationaccess-controlredacted

[Insufficient Authorization] Unauthenticated Delivery-Order API Exposes Other Customers' Personal Data

2 min read

Overview

The target platform's delivery-order lookup endpoint returned a normal response with no authentication error even when accessToken was null. Order IDs were a date plus a sequentially increasing six-digit counter, so an attacker could enumerate them and read the orderer's phone number, name, payment method and ordered items for any order without authentication.

This is an abridged record. The product name, vendor name, paths, parameter names and reproduction steps are masked.

Disclosure details

  • ID: FVE-2026-8617-74526
  • Group: Web
  • Status: Published
  • Severity: Medium (CVSS 7.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
  • Submitted: 2026-05-17, issued: 2026-06-12
  • Visibility: Redacted

Attack flow

[Step 1] Learn the order ID format
  - Call the new-order-ID issuance endpoint, reachable without authentication
  - Format confirmed as YYYYMMDD + six-digit sequential counter

[Step 2] Enumerate valid order IDs
  - Fix the date and increment the counter to find real orders
  - Valid order: 200 response / nonexistent order: a different response code

[Step 3] Read other customers' order details without authorization
  - Call the order lookup endpoint with accessToken=null
  - Exposes phone number, name, payment method, items and order time

Impact

  • Exposure of the orderer's phone number and real name
  • Exposure of the payment method (card issuer, payment type)
  • Exposure of ordered items, amount, time and delivery status
  • Can be abused for secondary harm such as smishing and voice phishing
  • Mass sequential enumeration can collect personal data of many people

Remediation

  1. Validate accessToken in server-side authentication middleware on every order lookup endpoint.
  2. Return 401 for invalid or null tokens.
  3. Replace order IDs with signed tokens or random UUID-based values.
  4. Verify on the server that the token owner matches the order owner.

Platform evaluation

  • Medium
  • AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/SH:B/DO:A

CWE

  • CWE-306: Missing Authentication for Critical Function
  • CWE-639: Authorization Bypass Through User-Controlled Key

Related Posts

[Insufficient Authorization] Unauthenticated Data API Exposes Real-Name Rosters and Staff Contacts

Masked FVE record: a data API with no authentication or authorization returned real-name rosters of residents' association officers, facility staff contacts and employee numbers in bulk.

2 min read

[Personal Data Exposure] Resident-Number-Based Linking Information Exposed by a Missing Authentication-Level Check

Masked FVE record: a missing authentication-level check let an anonymous session read a victim's resident-number-based linking information (CI) and identity details.

2 min read