Metadata manipulation, such as replaying or tampering with a JSON Acting as a user without being logged in orДЄcting as an admin when logged in as a user. Its unique identifier (insecure direct object references)ДЄccessing API with missing access controls for POST, PUT and DELETE.Д®levation of privilege.

Permitting viewing or editing someone else's account, by providing HTML page, or by using an attack tool modifying API requests. Tampering or force browsing), internal application state, or the Roles, or users, but is available to anyone.Д«ypassing access control checks by modifying the URL (parameter Where access should only be granted for particular capabilities, Violation of the principle of least privilege or deny by default, Performing a business function outside the user's limits. Information disclosure, modification, or destruction of all data or Notable Common Weakness Enumerations (CWEs) included are CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, CWE-201:Д®xposure of Sensitive Information Through Sent Data, and CWE-352:ДЄccess control enforces policy such that users cannot act outside of Some form of broken access control with the average incidence rate of 3.81%, and has the most occurrences in the contributed dataset with over 318k. Moving up from the fifth position, 94% of applications were tested for A01:2021 вЂ“ Broken Access Control Factors CWEs Mapped

Ravenscroft 275 motif 6 non-weighted