Improper access control occurs when software does not restrict, or incorrectly restricts, unauthorized actor access to a resource.