An IDOR on tenant settings
An IDOR on tenant settings: the ownership check applied on every other org-scoped route was missing here, so passing another organisation's id was enough.
It could not have worked
A race, an ordering, one column holding two things. The shape ruled it out before the code ran.
Straightforward IDOR — the ownership check every other organisation-scoped route applies wasn't applied on settings, so passing another organisation's id was enough. The more useful half of the fix was centralizing the ownership checks rather than leaving each controller to reimplement them, because "each route remembers" will keep producing this and had just produced its first confirmed miss.