IDOR in Downloadable Chat Transcripts
Sequential transcript filenames expose an authorization gap: changing the requested object retrieves another lab user's conversation and synthetic credential.
taxonomy / tag
#idor
Horizontal Privilege Escalation Through a User-Controlled Account ID
Changing the account identifier in the request returns another lab user's profile, demonstrating missing object-level authorization and exposing the synthetic API key.