In an authorized test, changing an invoice ID returns another user's invoice without a permission check. Which weakness is demonstrated?

1. A TCP SYN flood
2. An expired TLS certificate
3. Broken object-level authorization
4. A physical access-control failure