leak receipt of another user

How it was found

A attacker can leak receipt information of another user by using the forced browse. by changing single char here i see another user's receipt https://www.udemy.com/dashboard/pdf-receipt/?invnum=PD-CC-66574B6C57334B626B366B39 https://www.udemy.com/dashboard/pdf-receipt/?invnum=PD-CC-66574B6C57334B696B366B3D