IDOR happens when an application exposes a direct reference to an internal object — a database row ID, a file path, an account number — without verifying that the requesting user is actually allowed to access it. Change the ID in the URL or request body, and you’re looking at someone else’s data.
It’s an easy mistake to make. Most frameworks make it trivial to fetch a record by ID, and it’s easy to forget the authorization check when the happy path already works correctly during development and QA.
The fix is usually straightforward once found: verify ownership or permission on every object access, not just at the route level. The harder part is finding every place in a large codebase where that check might be missing.
