The application does not enforce proper access control, allowing an attacker to access unauthorized data or perform
unauthorized business functions.

Access control vulnerabilities may be caused by:

* Referencing content using primary keys and lack of validation of the content access permissions.
* CORS misconfiguration is allowing unauthorized API access.
* Metadata manipulation, such as replaying or tampering with access control tokens.
