Broken access control

Broken access control is the system failing to check whether you should be allowed to do the thing you just asked to do.

It is consistently among the most common serious flaws in web applications, and it is usually not subtle. Changing a number in a web address and seeing somebody else's invoice. Calling an administrative function directly because the button was merely hidden. The server has to make the decision on every request, because anything decided in the browser is a suggestion the user can overrule.