A healthcare application displays patient lab results. The URL pattern is /patient/lab-results/{patientId}. A logged-in physician (patient ID: 500) changes the URL to /patient/lab-results/501 and sees another patient's results. The application performs authentication but no authorization check. Which specific term describes this?

• A.Horizontal Privilege Escalation via Insecure Direct Object Reference (IDOR): the physician accesses a resource belonging to a peer at the same privilege level. The application authenticates the user but does not verify the user has authorization to access the specific resource identified in the URL
• B.Vertical Privilege Escalation via forced browsing (role elevation): the physician reaches a resource reserved for a higher role since the application checks the login but not the requested record
• C.Session Fixation (reuse of a known session ID): the physician keeps the identifier issued before login since the server does not regenerate it after authentication of the physician at the login page
• D.Broken Object Property Level Authorization (an API Top 10 term): the response exposes fields of the record since the serializer returns the whole object to the physician without a filter on properties