User ID controlled by request parameter, with unpredictable user IDs 1 Access Control Vulnerabilities Lab 6 Dec 4, 2024