Insecure Direct Object Reference on badoo.com

Summary

Hi, I want to report IDOR (Insecure Direct Object Reference) vulnerability to you. IDOR Details are here: https://www.owasp.org/index.php/Top_10_2010-A4-Insecure_Direct_Object_References https://www.owasp.org/index.php/Testing_for_Insecure_Direct_Object_References_%28OTG-AUTHZ-004%29

As the pages say: Insecure Direct Object References occur when an application provides direct access to objects based on user-supplied input. As a result of this vulnerability attackers can bypass authorization and access resources in the system directly, for example database records or files.

Insecure Direct Object References allow attackers to bypass authorization and access resources directly by modifying the value of a parameter used to directly point to an object. Such resources can be database entries belonging to other users, files in the system, and more. This is caused by the fact that the application takes user supplied input and uses it to retrieve an object without performing sufficient authorization checks.

Vulnerable url: https://badoo.com/api.phtml?SERVER_GET_USER