Access control failures, where permissions are misconfigured or defined too broadly, allowing attackers to take malicious actions.