One Number Away: How a Simple API Flaw Exposed Thousands of Citizens' Government Documents

A researcher discovered that a state government's API exposed identity documents for thousands of citizens through trivial parameter manipulation—changing one sequential ID number. The vulnerability required no sophisticated techniques and represents a catastrophic failure in basic authorization controls, exposing how vulnerable centralized citizen databases are to even the simplest attacks. This case reinforces that the most dangerous security oversights aren't complex technical failures, but fundamental access control gaps in systems handling citizens' most sensitive personal information.