An аpplicаtiоn uses аn "ID" in the URL tо shоw user profiles: https://app.com/user/123. A logged-in user changes the URL to https://app.com/user/124 and successfully views another user's private data. Which security failure occurred?