It is my understanding that good security design does not reveal information about data which the user is not allowed to access. This includes information about the existence of said data, i.e. if a user is not allowed to access entities of a certain type, they should also not be able to figure out whether an entity of that type with a certain ID exists.
A project I am currently working on does not support this consistently. For example a request to
/edit/record/52 will return an HTTP 404 error if the record with ID 52 does not exist and an HTTP 403 error if it does exist.
I'm unsure how much of a problem this is in terms of security. With this information alone, attackers can probably not do anything. My worry is that this enables attackers to aggregate information about data in the system (as we have several endpoints for different entities exhibiting this same behavior) which could then be used to attack the system. Admittedly, I do not have an attack scenario using this information laid out in my head, but I'm afraid this leakage might at least facilitate attacks. Unfortunately, changing this would require a bit of refactoring of our security architecture, which is why we didn't do it right away.
Is this a common attack vector? Should I be worried and fix this wherever possible? Or is leakage of information about existence of objects acceptable? Could you provide examples of well-known or high-profile attacks where leakage of seemingly insignificant data led to the compromise of a system?