How broken access control works
Authentication is not authorization. IDs are not secrets.
Logging in proves who you are. It says nothing about which objects you may touch — that second question is authorization, and applications skip it constantly. An order viewer that takes ?id=102 and never asks whether order 102 is yours serves anyone's order to anyone logged in. That is insecure direct object reference: the ID is direct, and nothing checks the reference.
Two directions. Horizontal escalation reads sideways: your account, someone else's data. Vertical escalation reads upward: a normal account reaching admin functions, usually by requesting URLs or parameters the interface never showed but the server still honors. Hidden is not protected — every endpoint must check, whether or not the UI links it.
The fix is server-side, per-object, on every request: does this authenticated principal own or outrank this object. Client-side hiding, unpredictable IDs, and hoping nobody guesses are all theater. Test by authenticating as the lowest-privilege user and requesting everything.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.