Difficulty: Intermediate
What is IDOR (Insecure Direct Object Reference)?
When an application provides direct access to objects based on user-supplied input (e.g., `api/users/123`), but fails to check if the current user has permission to see user 123.
AuthZ, RBAC, IDOR