Example: GET /orders/2 returns bob’s order to alice. The fix is an ownership check on the server for every read.
IDOR
Insecure direct object reference: an endpoint returns an object by its ID without checking that the caller may see it.
Example: GET /orders/2 returns bob’s order to alice. The fix is an ownership check on the server for every read.