Task 1 of 7

The Student Who Read 50,000 People's Grades

In 2019, a student at a US university noticed something while using the student portal. The URL for viewing his own academic transcript read /transcript?student_id=4291. Out of curiosity, he changed 4291 to 4290. Someone else's transcript loaded. He changed it to 1000. Another student's records appeared — name, grades, courses, personal details.

He reported it to the university. The system had been live for years. Every student ID was sequential. Anyone could have read anyone else's records simply by changing a number in the URL. No hacking tools. No special knowledge. Just curiosity.

IDOR HAS HIT SOME OF THE BIGGEST NAMES
Instagram — 2019
$30,000 bug bounty paid
Changing a user ID in an API request returned private photos of any account, including private profiles and Stories.
Parler — 2021
70M posts archived before shutdown
All 70 million public posts were scraped in order by incrementing post IDs. No authentication required. Posts thought deleted were still accessible.
US Postal Service — 2018
60 million accounts exposed
The USPS "Informed Delivery" API had no ownership check. Any logged-in user could query tracking data for any package by changing the ID.
Venmo — 2019
207M transactions downloaded
A researcher set up a script to pull public Venmo transactions using the API. Every transaction was accessible in order. He scraped 207 million transactions in a month.

Why it keeps happening

IDOR is the most reported vulnerability in bug bounty programs worldwide — year after year. The reason it keeps appearing is not that developers are careless. It is that access control checks are easy to forget. The code that fetches data and the code that checks permissions are often written separately — and sometimes the check just never gets added.

1

In the university transcript example, what single action allowed the student to access other people's records?

2

IDOR is consistently the most reported bug bounty vulnerability. What does this suggest about how it gets introduced?

Answer all 2 questions to continue