[SECURITY] Investigate and Patch Unauthorized Order Information Access (IDOR) Vulnerability [CVE-2025-12919]

Summary:

A security issue has been disclosed in a public advisory at ictrun/Evershop-Order-leak/README.md concerning an Insecure Direct Object Reference (IDOR) vulnerability in the EverShop GraphQL API. This issue allows unauthorized (unauthenticated) access to complete order information by abusing the order query endpoint. Customer personal data and full order details can be accessed by providing only the order UUID, as detailed in the linked advisory.

Reference:

• Security report with technical details and remediation guidance: ictrun/Evershop-Order-leak/README.md

Key Points:

• Publicly accessible endpoint (order query) missing authentication/authorization checks
• Potential exposure of personally identifiable information (PII)
• Proof-of-concept code and remediation steps provided in advisory

Actions Needed:

• Audit the order GraphQL resolver and related code paths
• Implement strict authentication and authorization checks as per advisory guidance
• Consider alternative guest/anonymous order access via secure tokens if required
• Review recent commits for already applied mitigations and verify patch completeness

CVE ID: CVE-2025-12919

Please see the full advisory for details, example queries, and patch recommendations.