The application does not enforoce propoer access control, allowing an attacker to access unauthorized data or perform unauthorized business functions.

Access control vulnerabilities may be caused by:

*   Referencing content using primary keys and lack of validation of the content access permissions.
*   CORS misconfiguration allowing unauthorized API access.
*   Metadata manipulation, such as replaying or tampering with a access control tokens.