https://cornucopia.owasp.org/cards/AZ9
OWASP Cornucopia - Website App Edition - Authorization (AZ9)
Michael can bypass the application to gain access to data because administrative tools or administrative interfaces are not secured adequately
website appowaspcornucopiaeditionauthorization