Insecure direct object reference
Also known as IDOR
Accessing another user's data by changing an identifier in a request, because the application does not check authorization.
Change the record number in a URL from your own to someone else's and the application returns their data. It happens when the application authenticates the user but never verifies they are entitled to the specific record.
Automated tools miss it constantly because nothing errors. It requires a tester who understands what the data means and what the user should be allowed to see.
Where this comes up
Insecure direct object reference sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.