Critical IDOR - Make Rule for Any Group & Any Venue remotely

How it was found

Hello Team,

I have found a critical IDOR vulnerability using which an attacker can make/create a rule for any group and any venue remotely by just changing the group_id and venue_id in the request.

Proof of Concept: Please find the attached screenshots.

Best Regards,

Hely H. Shah