Critical IDOR - Get Rules of any organization remotely

How it was found

Hello Team,

I have found a critical IDOR using which an attacker can get rules of any organization remotely by just changing the venue id in GET Request.

Proof of Concept: Please find the attached screenshots.

Best Regards,

Hely H. Shah