Paypal bug $10K - All Secondary users account takeover leads to unauthorized money transfer from paypal business accounts

Insecure Direct Object Reference (IDOR)