Broken access control: can one user reach another user’s data?
Being signed in should not give a person access to every record. The server must check permission for the specific object and action on every request.
Security Guides
Security Guides
Stolen session cookies: why a password reset may not end access
A session cookie can let a browser continue using an account after sign-in. If a session is stolen, changing the password may not revoke every active session or connected application.