Potential IDOR - Generic Data Access
Description
Detects route parameters flowing to generic data access without visible ownership verification.
How to fix
Verify ownership before returning data.
```python
if order['user_id'] != current_user.id:
return jsonify({'error': 'Forbidden'}), 403
```
Learn more: https://shoulder.dev/learn/python/cwe-639/idor-generic
Applies to
Languages
Frameworks
django
flask
fastapi
References
Scan for this issue
Detect with Shoulder CLI
npx @shoulderdev/cli trust --rule=python-idor-generic .