IDOR on partners.uber.com allows for a driver to override administrator documents

Summary

An IDOR in the /p3/drivers/uploadDocument endpoint on partners.uber.com allowed a driver to upload (and overwrite) documents for other drivers on a multi-driver account. In addition to this, there was an access control issue where a driver account could also upload (and overwrite) documents for the multi-driver account administrator. As a result, a driver could potentially escalate privilege to an account administrator.

Thanks, @vijay_kumar1110!