Broken access control
Users can see or do things their role should not allow.
Definition
It's the most common serious web risk: hidden buttons without server checks, admin pages open to normal users, or other users' data reachable by changing IDs.
In practice
A normal customer opens /admin by typing the URL, because the link was only hidden from the menu.
Learn it in context
Lessons that use this term.