Attackers do not need to Pay for a Subscription to get the `Discussion Group URL` in `Paid Learning`

Summary

The researcher reported an Insecure Direct Object Reference (IDOR) allowing an attacker to extract information about Learning Groups which is disclosed to only paid subscribers of the course.