A healthcare application displays patient lab results. The URL pattern is /patient/lab-results/{patientId}. A logged-in physician (patient ID: 500) changes the URL to /patient/lab-results/501 and sees another patient's results. The application performs authentication but no authorization check. Which specific term describes this?

• A.Horizontal Privilege Escalation via Insecure Direct Object Reference (IDOR): the physician accesses a resource belonging to a peer at the same privilege level. The application authenticates the user but does not verify the user has authorization to access the specific resource identified in the URL
• B.Vertical Privilege Escalation - the physician gained admin rights
• C.Session Fixation - the physician reused the patient's session
• D.SSRF - the server is fetching results from an internal database