IDOR comes under the Broken Access Control category of vulnerabilities defined by OWASP. Insecure Direct Object Reference is a fatal access control flaw that can enable an attack to gain access to privileged accounts. It is a serious risk to a system's integrity and security.