MediumData ProtectionA01:2021 – Broken Access Control (subsection)
An attacker tricks an authenticated user into submitting a forged request, causing the application to execute unwanted state-changing actions on the victim's behalf.
Immediate Response
1Identify and revert any unauthorized state changes caused by the attack.
2Temporarily add an Origin/Referer validation check on all sensitive endpoints.
3Notify affected users of unauthorized actions taken on their accounts.
