High severity Insecure Direct Object Reference allowing unauthorized access to user flags and permissions. Impact: Sensitive data exposure, user enumeration, potential privilege escalation. Remediation: Implement proper authorization checks to ensure users can only access their own data.