An IDOR (Insecure Direct Object Reference) attack happens when

1. IDOR: an application uses an INTERNAL OBJECT REFERENCE (database ID, filename) DIRECTLY in URLs/parameters, WITHOUT verifying the requester is authorised to access that object. 2. EXAMPLE: `GET /invoice?id=42` returns invoice 42 without checking if it belongs to the requesting user. Attacker changes to `id=43` and views someone else's invoice. 3. IDOR is a CLASSIC EXAMPLE of Broken Access Control (OWASP A01 2021). 4. MITIGATIONS: server-side authorisation check on every object access, indirect references (random UUIDs), per-user access matrix. 5. Other options are unrelated to authorisation logic. _Source: OWASP Top 10 2021 — A01 Broken Access Control (IDOR example)._