Not sure dumping this on Twitter qualifies as responsible disclosure, but interesting find nonetheless.
https://www.google.com/search?q=url+parameter+(vulnerability...
Since you used an elevator as a metaphor, to me, it’s like opening an unlocked elevator control panel to reroute the signals to achieve a goal that’s not possible via a locked panel; for example, access a floor that normally would require a high security key. Easy, yes, an intended use of the system, no. Would doing so potently be trespassing? Depends on the context, but possibly, if not likely, yes.
https://www.wikihow.com/Make-an-Elevator-an-Express-Elevator
"French journalist "hacks" govt by inputting correct URL, later fined $4,000+"
https://arstechnica.com/tech-policy/2014/02/french-journalis...