I was going to stay out of this debate other than to point out the irony since it's impossible to know what happened and to what extent it's an issue. First, I haven't seen specifics on the issue, so anything said is speculation. But, that doesn't seem to stop those that WANT to see this system fail. Why? I'm not sure.
If it's true that profiles belonging to other users are being seen, then it's possible there's an issue in the authentication services. Standard practice is to transmit true authentication information as little as possible. This would include the email address / password combo to sign into the system. Once sent, the normal practice is to use authentication ticket / tokens for future requests within the same session.
This problem may be due to an issue at the token level... with a token not being globally unique within the system. Disney uses a single sign on authentication method for a single account login to access multiple systems. Basically each user interface system takes the authentication data, transmits it for authentication, retrieves a token, and then uses that token to retrieve data from the backend systems. Normally, the token system is a singular module within the n-tier application that receives requests from multiple UI locations -- website, kiosks, mobile site, apps, etc. However, it's possible they created multiple modules for authentication for different UI systems. If so, the token may not be truly unique across all systems. So, a mobile app user gets a token of 123456789 that is connected to user ABC and a website user gets a token of 123456789 for a different user. Basically, the token is unique within the specific UI system, but not within the token cross reference for the backend system. This could explain the profile issue being reported.
As Flynn has already noted, an issue such as this could be introduced from multiple teams writing different parts of the system without access to singular modules usable for multiple teams. If this happened, it was probably due to trying to get the systems created by multiple teams to reduce application development timelines. Again, each team tested their systems without problems, but the unit tests were not built for combined system usage. I'm not downplaying the issue, just speculating on a possible cause. If this speculation is close to accurate, the good news is it's easily (design, not necessarily implementation) fixed by implementing a singular authentication token system shared by the different UI systems.
Finally, for full disclosure, I do not work for anyone remotely connected to NextGen...