Insecure Direct Object References occur when an application exposes internal object references (like database keys, file paths, or directory entries) without proper access control validation. Option (B) 'Unauthorised access to any webpage/webdata directly or indirectly' describes this - attackers manipulate direct object references to access unauthorized data. Option (A) relates to injection, (C) is about patching, and (B) correctly describes IDOR.