The backend wrongly trusted user input allowing the circumvention of
access control checks.