That’s such a benign vulnerability that it doesn’t even feel like one. Per your description, the worst thing an attacker can do is see the food ordered to a check number (in a public restaurant) and pay a bill that isn’t their own?
On the flip side, some services go absolutely overboard trying to secure low-blast-radius things, or don’t properly scale security to the risk of an activity. I have a service provider that requires an absurd login flow for their website, continually trying to force passkeys, short session timeouts, etc; when the worst an unauthorized attacker could do is pay my bill (the horror!).
On the flip side, some services go absolutely overboard trying to secure low-blast-radius things, or don’t properly scale security to the risk of an activity. I have a service provider that requires an absurd login flow for their website, continually trying to force passkeys, short session timeouts, etc; when the worst an unauthorized attacker could do is pay my bill (the horror!).