Comment by ConnorLeet

Possessing an ID, shouldn’t give access, regardless of whether it’s a numerical PK or a UUID. (Unless that’s a feature, like shareable links) Still need to check if the user should be able to use that ID.

If that isn’t implemented, the system isn’t secure, doesn’t matter which path you use.