Knowledge MaxxingAccess-control failure
An access-control failure occurs when a system fails to properly check that a user is authorised to view or modify a specific piece of data, letting them access something that isn't theirs.
Prerequisite: Authorisation
What matters
This is a common real-world vulnerability precisely because it requires actively checking authorisation on every relevant request, not just once at login.
Example
If changing the id in a URL from '/orders/101' to '/orders/102' lets a user view someone else's order without any check, that's an access-control failure.
Common misconception
An access-control failure isn't fixed by hiding a link or button; the server must enforce the check, since a hidden link doesn't stop a direct request.
Recall question
Why doesn't hiding a button in the interface fix an access-control failure?