Which scenario is an example of an IDOR vulnerability?

• A. Direct Object Reference where altering an object ID in a request accesses another user's data
• B. SQL injection via crafted input
• C. Cross-site scripting through input field
• D. CSRF token missing

Answer: (A)

An IDOR vulnerability occurs when the system relies on a user-supplied object identifier without properly enforcing access controls. If you can change an object ID in a request and retrieve someone else’s data, the server isn’t checking that you’re authorized to view that resource. That exact scenario—altering an object ID in a request to access another user’s data—demonstrates IDOR because the weakness is the inadequate authorization check for the referenced object.

The other options describe different flaws: SQL injection involves manipulating database queries through input, cross-site scripting injects malicious scripts into web pages, and a missing CSRF token leaves a site open to cross-site request forgery. Each is a distinct vulnerability with its own remediation.