Fixed direct id access vulnerability