[Broken Access Control ] Unauthorized Linking accounts & Linked Accounts info DIsclosure

Summary

@mr_asg discovered that users of an account with member permissions were improperly allowed to see activated linked accounts and connect new carts to the account.

I discovered a Vulnerability that allows the user who has member privileges to connect new carts to the Taxjar account , like (Shopify,xero,quickbooks,stripe,squarespace,etsy,ebay) by sending GET request to /auth/[CARTS-NAME]?authenticity_token=0