then i visited track your order and this is the url: https://target.track.ordercx.com/?shipment_id=MNNBH9TS14AFDT&_gl=1*1yhnifz*_gcl_au*MTc3NDk5MTk1MS4xNzc1NTI1NjAwLjE2OTA5NjkwMjAuMTc3NTU3Mzc1MC4xNzc1NTc0OTcz*_ga*MTk2NjU3NjcyNi4xNzc1NTI1NjAw*_ga_LB3H781E2R*czE3NzU1NzM3NDEkbzEzJGcxJHQxNzc1NTc0OTc5JGo2MCRsMCRoMA

this is the page:

None

then i copied the url and opened a private window then open the above url, i can see the order shipment without cookie session and authentication.

i try to bruteforced the shipment_id but still couldnot find a valid id. but i keep report this finding.

Alhamdulillah.