An access-control failure is a defect where a system applies, retains, or revokes permissions incorrectly. In practice, a user may keep access after a role change, gain access they were never meant to have, or be blocked from actions they should be allowed to perform.
This matters because access control is what separates ordinary users from admin functions, private data, and sensitive internal services. Attackers often look for these flaws to escalate privileges, read other users’ records, trigger restricted workflows, or reach internal network resources. In self-hosted Git and CI systems, for example, a weak approval check or stale authorization state can let untrusted code run where it should not. Defenses include least privilege, central authorization checks, immediate revocation on logout or role change, strong audit logging, and regular review of permission paths.