IDOR: Authorization Bypass in LockReport Mutation for public reports