The IDOR Fix Cursor Writes Stops at the GET Route (CWE-639)

TL;DR

Ask an AI editor to fix an IDOR and it will scope the one route you showed it, correctly, then leave PATCH, DELETE and the list endpoint sitting on primary-key lookups.

The unscoped list endpoint is the worse half. IDOR normally costs an attacker some ID enumeration, and a list endpoint that returns everyone's records hands those IDs over for free.

The fix that holds is structural: one owner-scoped accessor that every handler is forced through, so a new route cannot be written without the check.

I asked Cursor to fix an IDOR last week. It did, and the fix was correct.