Broken access control occurs if a user is able to access unauthorized resources directly without proper
authentication unauthorized resources can be what pages databases and directories applications have
various account types depending on the users such as admin operators reporting group etc. One common
problem is that developers restrict access to these accounts on the US side and neglect putting the
same Strickland's on the server side if exploited an attacker can easily have admin rights in order
to protect ourselves from broken access control.
It is always important to invalidate tokens and cookies after logout forced log in log out after a password
change and secure resources on the server itself and not only from the UI interface.