Yelp: IDOR in locid parameter allowing to view others accounts Profile Locations

The application transmits in many occasions the locid parameter via URL, which means that this parameter may be being logged in plan text in the Apache server access.log, if not in others also. The fact that this happens, makes this parameter vulnerable not only to be read from this log file, but also be seen in the screen of any persons computer (Image. 1). I have identified that if any user gets or can reach the value of locid (for example via the scenarios above mentioned), he can use this value, to access others accounts profile locations. The fact why this happens is that there is not any server side control in place, which validates that the locations which is being requested from user A, is indeed from user B. Here we see that if well the value of locid is a random hash, this security by obscurity does not provide any additional security, if the server is not controlling who access which information, and if the value of locid can be leaked via different vectors. In order to validate the both things I mention here, the following steps are: 1- Login to https://www.yelp.com/ 2- Go to https://www.yelp.com/profile_location 3- Click the Edit button and intercept the request that is made in Burp (you will see its a GET /profile_location/add_or_edit?nonce=&locid=) 4- Replace the value of locid with any of these valid locids from my account (wPhD_XkXv2z4Njqekn-sfg,yqLLfgos2xWB-Y9miJ8YcQ,pC5mbrTyFbCEaMHt4S4hqg,ZpA_GvjxD-06V_ElZfK7Uw) 5- You will see my profile locations....