🎯 New Report #3869124: **Unauthenticated IDOR allows modification of payment customer billing information**
🔺Severity: High
👽 Reporter: visionx7
⭐️ Reputation: 121
🛠 State: resolved
💼 Team: Weblate
💵 Bounty: null
🕐 Submitted: 2026-07-16
⏰ Disclosed: 2026-08-30 04:54:37
📝 Summary: The application contained an access control issue in the payment billing information edit functionality. An unauthenticated user was able to access the payment edit endpoint and modify the billing information associated with a payment without any authorization check. The issue occurred because the application allowed access to the edit page using only the payment identifier in the URL, and the server did not verify whether the requester was logged in or had permission to modify the customer information linked to that payment.
📂 Report JSON File: 3869124
@hackeronereports