Someone else's order in the account area: the page opens, the boundary does not
A customer changes a number in the address and sees someone else's order, receipt or thread. The site still "works". That is a pentest finding, not a ping.
An account area feels closed because it does not let you in without a sign-in. After that the logic is often simple: an order has a number, the page is built from that number, and the check "this order belongs to this person" got lost somewhere. The neighboring number opens. For a store owner this is not an abstract vulnerability. It is names, phones, addresses and sums.
A scanner of the homepage almost never sees this. The page looks normal, answers quickly and does not contain the word "error". Either a customer notices, or a review that deliberately looks at roles: guest, buyer, manager. For a manager the same hole is often wider: an "all orders" export on a link that can be forwarded.
What to do before a customer brings the news
- Walk two test accounts and open the first account's order from the second.
- The same for invoices, tickets, files and a delivery-address change.
- Check not only the screen, but the address the app or the ERP exchange uses.
- Do not fix this by hiding the number. Hiding it does not replace an ownership check.
Lexora puts exactly these scenarios into a website pentest when there is an account area or orders. The guide price is from $50 per endpoint, with a manual confirmation and a retest after the fix. If there is no account area, starting with a pentest is early: new clients get the free audit first. We describe a "someone else's order" finding as an impact on customers, not as a trick, so the developer understands what to close.
Related Lexora services
Does the account area have order numbers?
We will check whether one customer sees another's data. That work is under contract, on your test accounts.