Authorization Bypass Through User-Controlled Key

This flaw typically appears in features that fetch user-specific data, like account pages or search results. The application uses a key—such as a database ID, account number, or session token—to locate the correct record. However, if this key is taken directly from a user-controllable source like a URL parameter, form field, or cookie without verifying the requesting user's permissions, an attacker can simply change the key value to access data belonging to someone else. Attackers often exploit this by tampering with sequential, predictable, or easily-guessed identifiers. For instance, using a simple integer like `user_id=1001` and changing it to `1002` to access another account. The core failure is that the system performs a lookup based on the provided key but skips the critical authorization check to confirm the authenticated user actually owns or has the right to view that specific record.