Broken Object Level Authorization (BOLA)

Attacker can access resources of any user by adding user_id in URL.

Attacker can access resources of any user by changing the auth token in request.

Attacker can access resources of any user by changing the auth token in request and using older version of an API

Attacker can access resources of any user by introducing multiple parameters with same name.