Authenticated cart reuse via unchecked checkout identifier

Authorization bypass in givanz Vvveb before 1.0.8.3 allows remote authenticated users to reuse another user's cart during checkout. The checkout route loads the cart named by the URL cart_id and checks only that it contains products, without binding the cart to the current user or session. Any logged-in user who obtains a predictable cart identifier can feed that cart state into a valid checkout flow, affecting order creation, totals, and downstream business logic.