It sounds like A01- broken access control. Simply that judyrecords was marching through record ids and the backend was not authenticating that access. The backend I think they said is a relational database.

This is the most common security issue right now according to OWASP. You have to understand these issues come the fact that likely lawyers oversaw this project and they picked contractors that were "best value" (low cost).

https://owasp.org/Top10/A01_2021-Broken_Access_Control/