What it asks for. This category covers failures to enforce what authenticated or anonymous users are allowed to do, ranked first in the 2021 edition. Examples include accessing other users' records by changing an identifier, privilege escalation, missing access checks on API endpoints, CORS misconfiguration, metadata or token tampering and forced browsing to restricted pages.
In practice. Access control is enforced on the server side through a central, reusable mechanism, with deny by default for everything not explicitly allowed. Ownership of records is checked on every request, and access failures are logged and alerted on. Evidence includes an authorisation model, unit and integration tests for access rules, penetration test results and access control findings tracked to closure.
Common gaps. Checks are often present in the user interface but missing in the API. Object level authorisation on individual records is a particularly frequent gap.