IDOR

How a Missing Owner Check Exposed Every Order

A shopping API let any signed-in user read any order just by changing a number in the URL. The server checked that you were logged in, but never that the order…