IDOR allows an attacker to delete anyone’s featured photo.