NULLMOTH RECON

SECURITY REVIEW / REAL RESPONSE

Invoice access check

An authenticated user changes /api/invoices/123 to /api/invoices/124 and sees another customer's invoice. What is the flaw, the fix, and one regression test? Answer in under 45 words.

Flaw: Insecure Direct Object Reference (IDOR) due to missing ownership verification. Fix: Validate that the resource belongs to the authenticated user. Regression test: Request an invoice ID belonging to a different user and assert a 403 Forbidden response.

Recorded 21 Sep 2026 · Thinking off · Unedited