The vulnerability arises from a missing authentication check in the checkout session lookup handler of MarcosCamara01 Ecommerce Template. A remote attacker who possesses a valid Stripe Checkout Session identifier can issue a GET request to /api/stripe/checkout_sessions and receive the entire session object, which contains the buyer’s name, email, phone number, billing address, amount paid, and internal user identification. The flaw is a classic authentication bypass (CWE-306) that enables the disclosure of personally identifiable information without any authorization.

The flaw affects all deployments of MarcosCamara01 Ecommerce Template that have not incorporated the patch commit 91e273c. No explicit version numbers are listed in the advisory, but the issue exists in releases prior to that commit. The affected endpoint is GET /api/stripe/checkout_sessions, while sibling POST endpoints already enforce authentication.

The CVSS v3 score of 8.2 indicates a medium‑to‑high severity, but the EPSS score is not available, making it unclear how often attackers are turning this exploit into practice. The vulnerability is listed outside of CISA’s KEV catalog. Attackers can obtain the session identifier from the buyer’s browser after payment, as it is included in the success URL and can leak through Referer headers, analytics tools, server logs, or shared‑machine history. Once the identifier is captured, the attacker can recover full checkout session details for the victim, resulting in a privacy breach of sensitive customer data. The lack of authentication means the flaw is readily exploitable by any actor who can glean the session ID, and the potential impact includes identity theft, phishing, or social engineering attacks using the disclosed data.