Broken Access Control
The code implementation of the access control policy should be verified. Penetration testing can be useful in verifying if there are problems in the access control.In the web application, if there is categories of users that can be accessed through the interface, verify each interface to make sure that only authorized users can allowed access