By changing the URL with an existing id (marked as :id in https://app.raindrop.io/my/:id) any user can access any collection.

This issue raises a major privacy concern.