A city citizen portal shows another resident's case details when only the case ID in the URL is changed. What vulnerability class is this?
Select an answer to reveal the explanation.
Short Explanation
Guessing the next locker number should not open someone else's locker. When changing an ID exposes another user's record, authorization never checked ownership — that is IDOR. Horizontal or vertical privilege problems both start there.
Full Explanation
Insecure direct object references occur when applications accept object identifiers without verifying the caller is authorized for that object. The result can be horizontal access to peer data or vertical access to privileged records. Remediation requires server-side authorization on every object access, not obscurity of IDs. Clickjacking, password policy, and subdomain issues are separate finding types.