I have a few thoughts on this. How can you check a user's permissions without "user input"? That part is poorly written. Also, they present a query parameter

I have a few thoughts on this. How can you check a user's permissions without "user input"? That part is poorly written. Also, they present a query parameter containing an identifier in the URL as an example of an IDOR, but really everything on the web ultimately does this. This is not the vulnerability. It's that there aren't additional HTTP auth headers or auth parameters in the URL. I also question whether this web service was meant to be internet facing or an internal one. If so that's misuse of the software by people who aren't the web devs. It's common for auth to be handled by another service where the gateway in front of this is the security layer. If that gateway was misconfigured or just completely missing, that's the middleware team's fault. Also, > To help prevent data breaches due to IDOR bugs, the agencies suggest that vendors and web app developers implement secure-by-design principles at each stage of the software development process. Automated code analysis tools can also check for this kind of buggy code so that weaknesses can be fixed before stuff reaches production. This is such a piss poor answer to the actual problem here. Not everything boils down to code. This sounds like a lack of coordination due to mismanagement of a project. Blaming devs for this is a really bad look.