A broken access control issue occurs when a user is able to bypass a current policy and is able to access data and/or functionality outside of their intended permission.