**Unauthenticated IDOR allows modification of payment customer billing information**

How it was found

The application contains an access control issue in the payment billing information edit functionality. An unauthenticated user can access the payment edit endpoint and modify the billing information associated with a payment without any authorization check.

The issue occurs because the application allows access to the edit page using only the payment identifier in the URL. The server does not verify whether the requester is logged in or has permission to modify the customer information linked to that payment.

Steps to reproduce:

1. Create a payment object and note the payment UUID.

Example:

01f82084-20dc-498a-b004-2694d51be433

2. Open the following URL in a browser where you are not logged in:

http://127.0.0.1:8000/en/payment/01f82084-20dc-498a-b004-2694d51be433/edit/

3. Observe that the payment billing information edit page is accessible without authentication.

4. Modify the billing information fields.

Example changes:

Name:
IDOR_EVIDENCE_TEST

Address:
IDOR_ADDRESS_TEST

5. Submit the form.

6. The application accepts the request and updates the customer billing information.

7. Verify that the changes are stored by checking the customer record. The modified values remain saved:

Name: IDOR_EVIDENCE_TEST
Address: IDOR_ADDRESS_TEST

This demonstrates that an unauthenticated attacker can modify persistent customer billing information by accessing the payment edit endpoint directly.

The root cause appears to be missing authorization checks before allowing modification of the customer object associated with the payment.

Impact

An attacker can modify customer billing information without authentication by accessing the payment edit endpoint directly.

Successful exploitation allows unauthorized changes to stored customer data, including billing name and address information. These changes are persistent and affect the data saved in the application database.

Potential impacts include:

• Modification of customer billing records
• Incorrect customer information being stored and displayed
• Integrity loss of payment-related customer data
• Possible disruption of billing, invoicing, or payment-related workflows if modified information is used by the system

The issue affects the integrity of customer data because an unauthenticated attacker can make unauthorized changes without requiring account access or permission.