Chain: IDOR to Privilege Escalation
Canonical path
- IDOR modifies another user's sensitive object.
- Escalate role/permissions or steal recovery token.
- Perform admin-level action and show impact.
Validation
Demonstrate before/after authorization state and downstream privileged action evidence.