That’s such a benign vulnerability that it doesn’t even feel like one. Per your description, the worst thing an attacker can do is see the food ordered to a check number (in a public restaurant) and pay a bill that isn’t their own?

On the flip side, some services go absolutely overboard trying to secure low-blast-radius things, or don’t properly scale security to the risk of an activity. I have a service provider that requires an absurd login flow for their website, continually trying to force passkeys, short session timeouts, etc; when the worst an unauthorized attacker could do is pay my bill (the horror!).

> That’s such a benign vulnerability that it doesn’t even feel like one.

You could farm the data to see how the shop is doing.

Enumeration vulns are very serious, it’s just luck that this one appeared to be low risk.

Eh, there could be privacy implications. E.g. you see someone in the restaurant whom you know, and you know he is not supposed to be drinking alcohol (for whatever reason: maybe his religion forbids it, maybe there's a medical reason for it such as a prescription drug he's on that really should not be mixed with alcohol, the reason doesn't really matter in this example). You see that he was served a pork chop with a side salad, so you scan through the check numbers and find out that only one order contained a pork chop and a side salad that day, and that order also included a glass of red wine. Congratulations, you have spied on your acquaintance and obtained potential blackmail material on him. What will you do with it? How good or evil a person are you?

And although that's a low-probability scenario, it's also something that could be solved pretty easily, by either using a GUID or at least random numeric IDs with 8 digits.