Broken Access Control

This refers to flaws in the enforcement of access controls and authorization. If access controls are not properly implemented, attackers may be able to gain unauthorized access to functionalities or data.

# Vulnerable code (insufficient access control checks)
userId = request.getParameter("userId")
if isAuthorizedUser(userId):
    viewUserData(userId)

# Secure code (proper access control checks)
userId = request.getParameter("userId")
if isAuthorizedUser(userId, loggedInUserId):
    viewUserData(userId)