IDORInsecure Direct Object Reference
Definition
Access control vulnerability: the server exposes guessable or predictable IDs and doesn't validate that the requester is authorised to access that resource.
The most-hunted bug class for beginners — and for experts on large programs. Pattern: `GET /api/invoices/123` returns your invoice, change to `/api/invoices/124` and you get the next user's. No 403, no auth check.
Variants: horizontal IDOR (peer-to-peer), vertical (escalation to admin), write-side (PUT/DELETE on others' resources), predictable-UUID (UUIDv1 with MAC + timestamp, base64 IDs leaking info).
Defence: check ownership on EVERY resource endpoint, not in the frontend. Automated tests that change the ID and expect 403. ORM with per-user scoping (Rails default_scope + current_user, Django get_object_or_404 with filter). UUIDv4 random minimum (not v1).