✓ Exploit successful — you loaded invoice #1004, which belongs to dean — not your account. The server never checked ownership.
Objective Read an invoice that belongs to a different student — one you don't own.
💡 Show hint
You're looking at an invoice by its id in the URL (e.g. /invoice/1001). The id is just a number. What happens if you change it to 1002?
FlawThe server loads the invoice by id without checking it belongs to you (Broken Object-Level Authorization / IDOR).
FixEnforce ownership: only return the object if invoice.user_id == current_user, or the caller is staff.