diff --git a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
index d23f59e2e..d7acc42d9 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerability.java
@@ -77,8 +77,11 @@ public ResponseEntity<GenericVulnerabilityResponseBean<Object>> level1(
         String actualToken = cookieToken;
         try {
             if (actualToken != null) {
-                idorLoginService.decodeToken(actualToken);
+                User decodedUser = idorLoginService.decodeToken(actualToken);
                 if (id != null) {
+                    if (decodedUser.getUserId() != id) {
+                        return response(ACCESS_DENIED_INSUFFICIENT, false);
+                    }
                     User profile = fetchUserById(id);
                     if (profile == null) {
                         return response(USER_NOT_FOUND, false);
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
index 12b3b1cbd..4cdbe45e6 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/idor/IDORVulnerabilityTest.java
@@ -34,22 +34,38 @@ void setup() {
     }
 
     @Test
-    void level1_ShouldAllowAccessToAnyId() {
+    void level1_ShouldRejectAccessToAnotherUsersId() {
         String validToken = "valid-token";
         User decoded = new User();
         decoded.setUserId(1);
         decoded.setRole("USER");
-        User bob = new User(2, "Bob", 60000, "USER");
+
+        when(idorLoginService.decodeToken(validToken)).thenReturn(decoded);
+
+        ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
+                idor.level1(validToken, 2);
+
+        assertFalse(response.getBody().getIsValid());
+        assertEquals("Access Denied - Insufficient privileges", response.getBody().getContent());
+    }
+
+    @Test
+    void level1_ShouldAllowAccessToOwnId() {
+        String validToken = "valid-token";
+        User decoded = new User();
+        decoded.setUserId(1);
+        decoded.setRole("USER");
+        User alice = new User(1, "Alice", 50000, "USER");
 
         when(idorLoginService.decodeToken(validToken)).thenReturn(decoded);
         when(jdbcTemplate.query(
                         anyString(),
                         any(Object[].class),
                         any(org.springframework.jdbc.core.RowMapper.class)))
-                .thenReturn(Arrays.asList(bob));
+                .thenReturn(Arrays.asList(alice));
 
         ResponseEntity<GenericVulnerabilityResponseBean<Object>> response =
-                idor.level1(validToken, 2);
+                idor.level1(validToken, 1);
 
         assertTrue(response.getBody().getIsValid());
     }