Insecure Direct Object Reference / broken access control on web objects. Load when a request references an object by id you can change: /account/1234, ?invoice=987, UUIDs in URLs/bodies, "download", "view", "edit" endpoints, numeric or guessable identifiers, or multi-tenant apps. Signals: sequential IDs, object refs in JSON, role/owner not re-checked.
