Separate authentication from authorization in review
Most access bugs are objects fetched by id without an ownership check, not missing login gates.
Tag: idor
Mass assignment to escalate your own role
Endpoints that bind the whole request body to a model often accept fields the UI never sends, like role or isAdmin.
Web cache deception on authenticated pages
Trick a CDN into caching a victim's private page by appending a static-looking extension the origin ignores but the cache keys on.