I see all of your users: IDOR in API

Test API to see if you can actually access user data

Fact: you don't need to be logged in to test this one.