Mapped 38 endpoints behind authentication. Object identifiers are numeric and passed directly in the URL path — /api/orders/:id, /api/invoices/:id, /api/profiles/:id.
An authenticated user may read only objects owned by their own account. A request for another account's object must return 403 or 404 — never 200 with data.
If ownership is checked only at login and the URL id is trusted thereafter, substituting another account's id will return that object. Falsifiable in two requests.
Invariant violated. Session A read account B's order — ownership is never enforced server-side. This is BOLA, not a misconfiguration.
Re-testing sibling endpoints to establish blast radius: /invoices/:id and /profiles/:id share the pattern. 3 endpoints affected.
Escalating to senior operator with evidence bundle — 4 requests, 4 responses, account diff.
✓ Operator reproduced and confirmed — no false positive.