Very believable. Many, many years ago when auditing a health company website we found a similar "exploit". If any member of the public created a record, there

Very believable. Many, many years ago when auditing a health company website we found a similar "exploit". If any member of the public created a record, there was a page which was (something like) /display.php?record=123. Needless to say if you altered the ID you could read every other medical record. The company took some persuading to even understand that this was a problem, never mind actually fixing it. (Since this was a commercial job, I won't mention the company name)