IDOR in the IETF Datatracker

While browsing the IETF's submission platform, I discovered an Insecure Direct Object Reference (IDOR) vulnerability. By manipulating object references in requests, I was able to access draft and pending submissions that had not yet been validated or were under manual review by the secretariat. Beyond unauthorized read access, the vulnerability also allowed me to modify the content of those submissions and delete them entirely, without any authorization check being enforced server-side.