Read about an interesting scenario of IDOR that allowed to me view private user information and also delete publicly available list.