Manually Proving and Documenting an IDOR (CWE-639) — A Full Walkthrough

Most IDOR write-ups stop at "change the ID in the URL and you get someone else's data." That's the...