IDOR (Insecure Direct Object Reference)
Also called: BOLA, Broken object level authorization
A security bug where the server returns or changes an object just because the client knows its id, without checking that the caller owns it.
Definition
Authentication proves who the caller is; it doesn't prove they may access order 1042. IDOR (called BOLA, Broken Object Level Authorization, in the OWASP API list) happens when an endpoint loads an object by the id from the URL and never checks ownership. The fix is to scope every query to the caller, for example findByIdAndCustomerId(id, userId), and to return 404 rather than 403 for objects that aren't theirs.
In practice
Changing /api/orders/1042 to /api/orders/1043 shows another customer's order and address.