IDOR/BOLA

If changing a number in a request returns somebody else's data, the application is not checking who you are.

It is the simplest flaw to find and one of the most common. Invoice 1041 loads yours, so try 1042. No tooling is required and no skill, which is why it is routinely discovered by ordinary users by accident. The underlying mistake is assuming that because the interface only ever offers you your own records, nobody will ask for anybody else's.