In the Open

Insecure Direct Object Reference (IDOR)

Changing URL parameters.