* Bypassing access control checks by modifying the URL, internal application state, or the HTML page, or simply using a custom API attack tool. * Allowing the primary key to be changed to another's users record, permitting viewing or editing someone else's account. * Elevation of privilege.