Access control weakness
Can one user access another user’s records?
- Evidence
- Reproducible steps and affected endpoint
- Impact
- Exposure assessed in the client’s context
- Remediation
- Enforce ownership checks on the server
- Verification
- Retest the original scenario after the fix
