EXERCISE 1 — Classify each broken-access-control form
======================================================

(a) Changing ?userId=500 to read another profile.
    FORM: IDOR (Insecure Direct Object Reference) — a HORIZONTAL privilege
    escalation.
    WHY: the request exposes a direct reference (userId) to an object, and the
    server returns it WITHOUT checking that the requesting user owns/may access
    profile 500. The attacker accesses ANOTHER USER'S data at the SAME
    privilege level (user -> user) by tampering with the identifier. IDOR is
    the mechanism; horizontal escalation is the effect.

(b) A standard user POSTing to /admin/api/deleteUser.
    FORM: Missing function-level access control -> VERTICAL privilege
    escalation.
    WHY: an administrative FUNCTION is reachable by a non-admin because the
    endpoint isn't restricted to admins server-side (the UI just doesn't show
    it). The user gains HIGHER privilege (user -> admin capability). It's
    "missing function-level access control" as the flaw, "vertical escalation"
    as the outcome.

(c) Editing a JWT's role claim to admin.
    FORM: Metadata / token tampering -> VERTICAL privilege escalation.
    WHY: the attacker modifies a token/metadata value (the role claim) that the
    server trusts for authorization, elevating themselves to admin. (This only
    works if the server fails to verify the token's signature / trusts a
    client-modifiable value — note the JWT alg/verification lessons from the
    Auth course.) Tampering with the credential's contents to gain rights.

(d) Visiting an unlinked /reports/all that has no check.
    FORM: Forced browsing -> (here) unauthorized access / possible vertical
    escalation.
    WHY: the resource isn't linked in the UI, but the attacker GUESSES/visits
    the URL directly and it returns data because there's NO server-side access
    check — relying on the URL being "hidden" (security through obscurity).
    Forced browsing exploits the assumption that unlinked = unreachable.

SUMMARY:
  (a) IDOR / horizontal escalation
  (b) missing function-level control / vertical escalation
  (c) token (metadata) tampering / vertical escalation
  (d) forced browsing / unauthorized access

UNIFYING POINT:
  Every one is the same failure — the server did NOT make a proper server-side
  authorization decision based on the authenticated session's permissions for
  THIS object/function. The fix in each: enforce access control server-side,
  per request, checking the user's rights to the specific resource/action —
  never trusting client-supplied IDs/roles or the obscurity of a URL.