Shopify: Order lookup features of Shopify Chat Application leads to customer orders enumeration due to lack of user input validation

It came to my attention that the Shopify Chat application allows a customer to retrieve its order status by only providing the order email and number. Noticing that it results in being provided the order status page link, I started playing a bit with both parameters and I found out that it is possible to: 1. Access any customer first order without having to provide any actual order number 1. Provide multiple order number within the same payload resulting in orders "enumeration" As it stands, I'm not sure if it has to do with SQL injection. I'll keep digging. Steps to reproduce Having a shop with Shopify Chat application installed (with OrderLookup feature), open up https://{shop}.myshopify.com/?chat Within the Shopify Chat Widget, click on I need an update on my order Click on Enter order information and fill in the form by entering any customer email and order number Using Burp Client and/or any other way to intercept the request that is being made to https://shopify-chat.shopifycloud.com/api/storefront/conversations/{id}/order_lookup and copy its content so it can be replayed The intercepted payload should looks like this: { "order_lookup": { "email": "[email protected]", "order_number":"1000" } } As mentioned earlier, there's two different exploit. First one: Access any customer's first order details From the above payload: 1. Update email value to the targeted customer email address 1. Update order_number value to 1 OR...