User ID controlled by request parameter, with unpredictable user IDs 1 Access Control Vulnerabilities Lab 6 04/12/2024