05982dbc_OWASP_and_Theatre_Manager__Description
[0] A4 A direct object reference occurs when a developer exposes a reference to an internal implementation object, such as a file, directory, or database key. Without an access control check or other protection, attackers can manipulate these references to access unauthorized data. Theatre Manage does not allow direct access to any object in the database through the use of an API. Users cannot retrieve data in an unauthorized way as all queries are done via a controlled API. [Description] 
Insecure Direct Object References
OWASP and Theatre Manager
Description