This vulnerability (CWE-306) arises from missing authentication on a critical function in the checkout session lookup handler of MarcosCamara01 Ecommerce Template before commit 91e273c. The GET handler at /api/stripe/checkout_sessions calls stripe.checkout.sessions.retrieve() without verifying that the requester is authenticated or owns the session. As a result, anyone with a valid Stripe Checkout Session ID (which is exposed in the buyer's browser URL) can retrieve the full session object containing personal and payment information. Other related endpoints enforce authentication, but this one does not, leading to a significant information disclosure risk.

An unauthenticated remote attacker who obtains a valid Stripe Checkout Session ID can access sensitive buyer information including name, email, phone number, billing address, amount paid, and internal userId. The session ID is exposed in the buyer's browser URL after payment, which can leak through Referer headers, analytics tools, server logs, or shared browser histories, thereby increasing the likelihood of unauthorized data access and privacy violations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the GET /api/stripe/checkout_sessions endpoint by implementing proper authentication and authorization checks to ensure only the session owner can retrieve session data. Avoid exposing the session ID in URLs or other client-side locations where it can be leaked.