An iPhone app, called Acr call recorder, allows you to record your phone calls. A lot of people find this handy. (I'm not quite sure why. When I'm done with a call, I've got notes and action items, but I don't need the whole call. But, to each his or her own ...)
Well, apparently it's quite insecure. For one thing, it stores you calls in the cloud. For another, it uses no authentication when it retrieves them. It also uses insecure direct object referencing (IDOR), and so, with a little guesswork and experimentation, anybody can retrieve any calls at all from the system.
By the way, the "community," for the most part, also uses IDOR. Now, most of the "community" is open to the world, so this is hardly a problem (or news), but I detailed some of it in another posting, and even turn it to my advantage. For example, that other posting is at
but you can also get it if you specify https://community.isc2.org/t5/T/A/m-p/34471. There are significant sections of the URL that really do nothing, and can be modified. As another example, the URL for this post is