A user changes an invoice ID in the URL and sees another customer’s invoice. What failed?

The application has an object-level authorization failure: it accepted an identifier without confirming the requester may access that specific invoice. Query within the authenticated user’s permitted account or explicitly authorize the object before returning it. Apply the rule to downloads, exports, and nested resources as well as detail pages. Random identifiers reduce guessing but do not enforce access control. Add negative tests across two accounts and log suspicious attempts without exposing invoice contents. Review related endpoints because this pattern often repeats across a resource family.