You are uid 2. Each order is /m02-p/naked/idor-numeric/api/orders/<id>. The id is a direct object reference and nothing checks the order is yours. Read one of yours, then a neighbouring id.
/m02-p/naked/idor-numeric/api/orders/<id>