An insecure direct object reference occurs in the REST Documents API for the ticket module. Authenticated API users can access ticket attachments belonging to other companies because the system fails to perform a company-scope check. This check is typically applied via a session variable during public ticket authentication, which is not set during REST API authentication. Users with ticket read permissions can enumerate predictable ticket identifiers and provide them to the documents endpoint or download path to retrieve sensitive files, such as invoices and contracts, belonging to third parties.