Neighbor's Invoice

GET /api/invoices/1043 returns your invoice. You change the id to 1044 and receive another company's invoice. The handler verifies the session is valid and that the token carries the invoices:read scope. What is the actual defect?

The session token was accepted without re-validation, so a replayed token worked

The handler never checks that invoice 1044 belongs to the caller's tenant

Sequential integer ids are guessable, so the primary key should be a random UUID

The invoices:read scope is too coarse and should be issued per invoice id