Ruby : Insecure direct object references

Insecure Direct Object Reference is an access control problem which allows an attacker to view data by manipulating an identifier (for example, a document or account number).

Direct object references are maps of an identifier to a resource; they are insecure direct object references if they allow an unauthorized user to access data.