CRUD is a shorthand for Create, Read, Update, and Delete-the four basic operations applications use to manage data. In APIs, databases, and admin tools, these actions map to common endpoints or generated queries that add records, fetch records, modify records, or remove them.
In cyber security, CRUD matters because each operation needs its own authorization check. A user may be allowed to read a record but not update or delete it. Attackers often look for broken access control where a low-privilege account can invoke privileged CRUD actions through direct requests, hidden endpoints, or auto-generated API behavior. Defenders test CRUD paths carefully, especially in GraphQL and other schema-driven systems, to ensure that authentication does not accidentally expose mutation or deletion rights.