IDOR — insecure direct object reference — sounds minor until you chain it with something else. Here’s a pattern we see often enough that it’s worth explaining.
Step one: a session token that increments predictably rather than using a cryptographically random value. Step two: an internal support endpoint that trusts the session token’s role claim without re-verifying it server-side. Step three: request the support endpoint with a guessed token for a support-tier account, and the response includes admin-level capability.
None of these three issues alone is critical. Chained together, they’re a full account takeover path — which is exactly why we test for chains, not just individual findings.