Just discovered a cool privilege escaltion! 

User A has access with TASKs
User B has no access with TASKs

Still, User B can delete any Task! 

IDOR allows this attack! 
GET /org/tasks/DeleteTask/3584041
Still Always play with numbers....
#bugbounty #bugbountytips