Anonymous users can no longer retrieve the private data of registered customers. To prevent malicious attacks of this type, the quote_id_mask table of the Quote API no longer includes a cart_id_mask value.
Only a registered customer can assign a guest cart to himself. Previously, an anonymous user could modify the state (that is, set an active quote) of a registered customer.
Part of patch MAGENTO 2.0.6 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2
- Magento 2.0.1
- Magento 2.0.2
- Magento 2.0.3
- Magento 2.0.4
- Magento 2.0.5