This flaw should be graded by capability and exploitability.
Capability falls into the following categories:
- The ability to alter information on the system that you should not be able to.
- The ability to view information on the system that you should not be able to, such that a person's personal information is revealed, or credentials (or other items of information) are leaked that may aid an attacker in gaining further access to the system.
- The ability to view incidental information on the system that you should not be able to, e.g. the sum of the prices of items in another user's basket on an e-commerce site.
- No ability.
Exploitability falls into the following categories:
- Trivially exploitable in a reliable manner, e.g. admin's user is always ID 1, or users are always given sequential IDs.
- Moderately difficult to exploit, e.g. having to search through a sequence of 24-bit integers for potential identifiers.
- Difficult to exploit, e.g. computing Gn+1 from G0..n, where G is a poor quality random number generator.
- Impossible* to exploit, e.g. the problem equates to brute forcing a 128-bit keyspace. (* impossible = highly improbable, and way outside the cost/benefit ratio for attackers)
Note that this is not an integer scale - feel free to rate something as, for example, a 2.5 in capability.
The trick is that without exploitability, capability is pointless, and without capability, exploitability is meaningless.
In order to grade this, consider the above points, and compare your ratings to the importance of the protected resource. Also remember that sequential IDs make development easy, so the risk analysis should take this into account.
As a rule of thumb, if you're looking at anything worth protecting, and the mean average of the two numbers is less than 2, call it a high. If it's greater than two, it's entirely subjective.
I also suggest you take a look at the Common Vulnerability Scoring System (CVSS) and NVD's CVSSv2 calculator, which does a great job of demonstrating vulnerability assessment and scoring.