Critical IDOR - Can select any Parent while creating new Venue

How it was found

Hello Team,

I have found a critical IDOR vulnerability which allows an attacker to select any parent while creating a new venue remotely by just changing the "parent" parameter in the request.

Proof of Concept: Please find it attached.

Best Regards,

Hely H. Shah