Udemy: leak receipt of another user

A attacker can leak receipt information of another user by using the forced browse. by changing single char here i see another user's receipt https://www.udemy.com/dashboard/pdf-receipt/?invnum=PD-CC-66574B6C57334B626B366B39...