An IDOR that can lead to enumeration of a user and disclosure of email and phone number within cashier