See admin note. flag{ratcloud_idor_ticket_owner_bypass}
Comments are stored and rendered to anyone who opens the ticket. Also: the id is a direct object reference with no ownership check.