An information disclosure issue exists in the `OrderConfirmationController::init()` function. Unauthenticated attackers can obtain guest order references and email addresses by providing guest `id cart` values. By iterating through sequential `id cart` values and reading the Location redirect header, attackers can view booking details via guest-tracking and subsequently convert guest profiles into full accounts using passwords chosen by the attacker.