Sophos Cyberoam UTM CR25iNG version 10.6.3 MR-5 suffers from an insecure direct object reference vulnerability.