A healthcare application displays patient lab results. The URL pattern is /patient/lab-results/{patientId}. A logged-in physician (patient ID: 500) changes the URL to /patient/lab-results/501 and sees another patient's results. The application performs authentication but no authorization check. Which specific term describes this?

• A.Horizontal Privilege Escalation via Insecure Direct Object Reference (IDOR): the physician accesses a resource belonging to a peer at the same privilege level. The application authenticates the user but does not verify the user has authorization to access the specific resource identified in the URL
• B.Session Fixation - the physician reused the patient's session
• C.Vertical Privilege Escalation - the physician gained admin rights; broken access control is detected reliably by automated scanners because authorization rules are declared in HTTP headers; prototype pollution affects only server-side Node.js code because browsers freeze Object.prototype since ES2015; unvalidated redirects are mitigated by using 307 instead of 302, since strict redirects preserve the original origin check
• D.SSRF - the server is fetching results from an internal database