The app authors could have simply read OWASP and been fine, this appears to be direct object access issues, in other words, they had no check to verify that the

The app authors could have simply read OWASP and been fine, this appears to be direct object access issues, in other words, they had no check to verify that the user sending the request actually had permission to any of the things they requested. Everything else is just manually issuing commands to a "RESTful" interface which does not care which account issues the command. https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Proje...