IDOR 2 User ID controlled by request parameter Jun 2, 2024 User ID controlled by request parameter, with unpredictable user IDs May 16, 2024