Authentication & Secrets
IDOR
Also: insecure direct object reference, broken object level authorization
Returning an object because a request named it, without checking the requester may see it.
In more detail
Changing invoice 1001 to 1002 in a URL shows another user's invoice if the server only checks that you are logged in. The fix is an ownership or permission check on every fetch, not hiding the identifiers.