219,665 Records Through One API Endpoint: Broken Object-Level Authorization in Production

Gangnam Unni is a South Korean platform that connects people with cosmetic surgery clinics. On **September 4, 2026**, an API used to look up consultation records was accessed abnormally. The operator,