Someone Else's Invoice

IDOR — Insecure Direct Object Reference — is one of the most common real-world bugs. You're shown your record by ID. If the app never checks that the record is actually yours, just changing the ID hands you everyone else's.

Your invoices

You're logged in as customer #42. Your invoice is #1042. Open it — then notice the ID in the box and try a few others.

The app trusts the ID you give it and never checks ownership. Yours is 1042 — but invoices are numbered sequentially. Walk the numbers near the start of the range (1000, 1001, 1002…). One belongs to an admin.

Submit the flag

Why it matters: every record fetch must verify the requester is authorized for that specific object. "They have the link/ID" is not authorization.