It's just a classic IDOR, it's very easy to fall into with some frameworks. If you look, you see it everywhere. When stack-exchange rolled out their CV feature

It's just a classic IDOR, it's very easy to fall into with some frameworks. If you look, you see it everywhere. When stack-exchange rolled out their CV feature they had a similar thing which leaked everyone's email address regardless of the public profile visibility or whether they had even used the CV feature.