Yuma AI – Unauthenticated personal data and order information disclosure

A vulnerability was identified in Yuma AI Chat AI (a chatbot), a SaaS solution integrated into multiple e-commerce websites. Chat AI allows any unauthenticated user to retrieve sensitive order information including purchased items and shipping addresses belonging to arbitrary customers, simply by providing a customer email address or an order number.