The Ravens’ members site gives each member a record holding their private stash code, and it shows the record by the number in the URL. The falcon got in with a guest account whose record is 1050. The numbers are sequential, the leader’s record is one of the first, and there is no check of who owns the record.
The Ravens members directory serves a record by the number in the path, members/number. You are signed in as guest, number 1050, and the number is right there in the address bar, so you can change it yourself — that is forced browsing. The records are sequential and the leader is among the first.
Read the leader’s record and get his stash code, even though it is not your record.
You requested a record you do not own and got the leader’s record.
Why the solution worked
This is IDOR, an insecure direct object reference. The site shows the record by its number and never checks that the current account owns that record, so any member can read everyone’s records just by changing the number. The fix: authorize on the server for every object request — ask whether the current user owns or may access this record before returning it. Hiding the number is not enough; the check is the fix.
The root cause
The server returns the record matching the number with no check that the current user owns it. The missing object-level ownership check is the heart of IDOR.
How the code is fixed
Rule: check ownership at the object level on every request. Never trust an object id the user sends without checking who owns it.
Vulnerable code
app.get('/record', (req, res) => {
if (!req.session.user) return res.status(401).end();
// No ownership check: any logged-in user reads any record.
res.json(db.record(req.query.id));
});
Safe code
app.get('/record', (req, res) => {
if (!req.session.user) return res.status(401).end();
const record = db.record(req.query.id);
// Authorize the object: does this user own it (or have rights to it)?
if (!record || record.ownerId !== req.session.user) return res.status(403).end();
res.json(record);
});
Impact in the real world
IDOR is one of the most lucrative bugs in bounty programs; simply changing a number in a URL has leaked medical records, invoices and the account data of millions.
How defenders detect it
Defenders alert when one user accesses many ids that are not theirs in a short window, and enforce the ownership check in the data layer, not only the UI.
