Zomato: Attacker shall recieve order updates on whatsapp for users who have activated whatsapp notification

H Summary: 1. Order ID are IDOR Insecure Direct Object Reference 2. When users activated whats app notification an attacker would start receiving the notification without user interaction about their order. Proof Of Concept:- When an user order on a restaurant he/she can start whatsapp notificati...