Missing object-level authorization allows cross-user data access

Database queries retrieve objects by ID without scoping to the current authenticated user. Attackers can access other users' data by changing ID parameters in URLs or API requests.

Always scope querysets to current user. In function views: invoice = get_object_or_404(Invoice, id=invoice_id, user=request.user). In class-based views: override get_queryset() to return Model.objects.filter(user=self.request.user). Test by attempting to access another user's object ID.