A misconfigured endpoint on Express's e-commerce platform allowed unauthorized access to customer order data, a situation verified by TechCrunch. The vulnerability stemmed from a predictable, sequential order numbering system used in web addresses for order confirmations. By incrementing the order ID parameter in the URL, one could retrieve the personal and transactional details of other shoppers.

The exposed data fields included names, contact information, physical addresses, purchased items, and partial payment card details. Security advocate Rey Bango discovered the flaw during a personal investigation, finding no clear channel to report it to the company directly.

From an engineering perspective, this incident highlights a critical system design failure: using incremental, non-randomized identifiers for sensitive resources without proper authorization checks. The architecture allowed direct object references without validating the requesting user's session against the order owner. Fixing such a flaw typically involves implementing server-side access controls and moving to unguessable, globally unique identifiers (GUIDs) for all customer-facing resource keys.

After notification, Express deployed a patch but provided no technical details on the remediation. The company declined to comment on whether it maintains the access logs necessary to audit potential data exposure or if it will establish a formal vulnerability disclosure program. This case follows a pattern of data exposure incidents where backend authorization logic is absent, not broken, underscoring a common trade-off between development simplicity and security rigor in fast-moving retail environments.

Source: TechCrunch