An API flaw where a caller can act on an object without permission for that specific object and action.