Object fetched by request id with no owner check (IDOR)

What it is

A handler reads a record by an id taken from the request and returns it without checking that the record belongs to the caller.

Why it matters

This is IDOR, and it needs no exploit — changing a number in the URL is the whole attack. The endpoint returns 200 and logs a successful request, so nothing distinguishes the enumeration from ordinary use.

How to fix it

Scope the lookup to the caller: query by both the record id and the authenticated user or tenant id, so a mismatch returns nothing. Do the check in the query rather than after it, and prefer unguessable ids as defence in depth, not as the control.