Glossary: Web App Security and Authentication

IDOR

Also written: insecure direct object reference

Fetching a record by an id from the request without checking whether this user may see it, such as Bloom changing /orders/1 to /orders/2.