IDOR parameter

Tags: idor, bac, ato, api

Typical severity: P1-P4

What it becomes

The param is inventory until you prove a second user can read or write the object.

Where to look

• /api/users/{id}

  Copy

• GraphQL node(id:)

  Copy

• export?id=

  Copy

• invoice PDF

  Copy

• support-ticket attachments

  Copy

• WebSocket subscribe

  Copy

Chains

• Mass data access — Predictable IDs plus no rate limit plus a list endpoint or a range.
• ATO — Change email / password / 2FA on another userId.
• Privilege escalation — role, isAdmin, organisationId in the same body as a user-owned object.

Notes

• UUID is not access control. UUIDs leak in other responses, emails, and JS.
• Always test GET, POST, PUT, PATCH, DELETE, and the GraphQL mutation of the same object.