IDOR vulnerabilities occur when a web application exposes a direct reference to an object, like a file or a database resource, which the end-user can directly control to obtain access to other similar objects.
an IDOR vulnerability mainly exists due to the lack of an access control on the back-end not because there is a direct reference to an object.
RBAC implementation can help this - https://en.wikipedia.org/wiki/Role-based_access_control
Id IDORs
study the HTTP requests to look for URL parameters or APIs with an object reference (e.g. ?uid=1 or ?filename=file_1.pdf).
