Insecure Direct Object Reference (IDOR)

When it applies

The app trusts a client-supplied identifier to decide which object to return or mutate, and authorization is checked at the route ("is logged in?") but not at the object ("does THIS user own THIS object?").

Why it works

Access control is missing at the data layer. The server maps id → row and returns it without asking whether the current session is allowed that row. Sequential/predictable ids make enumeration trivial; even UUIDs leak (in listings, referrers, other endpoints).