{"action":"opened","issue":{"url":"https://api.github.com/repos/magento/magento2/issues/1107","labels_url":"https://api.github.com/repos/magento/magento2/issues/1107/labels{/name}","comments_url":"https://api.github.com/repos/magento/magento2/issues/1107/comments","events_url":"https://api.github.com/repos/magento/magento2/issues/1107/events","html_url":"https://github.com/magento/magento2/issues/1107","id":62865336,"number":1107,"title":"Serious security issue in Customer Address edit section","user":{"login":"kalpmehta","id":9616066,"avatar_url":"https://avatars.githubusercontent.com/u/9616066?v=3","gravatar_id":"","url":"https://api.github.com/users/kalpmehta","html_url":"https://github.com/kalpmehta","followers_url":"https://api.github.com/users/kalpmehta/followers","following_url":"https://api.github.com/users/kalpmehta/following{/other_user}","gists_url":"https://api.github.com/users/kalpmehta/gists{/gist_id}","starred_url":"https://api.github.com/users/kalpmehta/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kalpmehta/subscriptions","organizations_url":"https://api.github.com/users/kalpmehta/orgs","repos_url":"https://api.github.com/users/kalpmehta/repos","events_url":"https://api.github.com/users/kalpmehta/events{/privacy}","received_events_url":"https://api.github.com/users/kalpmehta/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-03-19T03:42:31Z","updated_at":"2015-03-19T03:42:31Z","closed_at":null,"body":"I have installed Magento2 latest version yesterday and was checking it today. I found a serious issue where customer can view/edit (yes EDIT!) another customer's address. It's very simple to reproduce, just change the ID of the address in the URL and you will be presented with that address to edit.\r\n\r\nProof of concept:\r\n- Register as a website user\r\n- Navigate to /customer/address/edit/id/[ANY-VALID-ADDRESS-ID]\r\n- View and/or Edit it\r\n \r\nhttp://www.example.com/customer/address/edit/id/1/\r\nI will be able to see that address (even if it's not mine) and will be allowed to edit it without any issue.\r\n\r\nPlease fix this ASAP. Thanks!"}}