Broken Access Control: How QA Tests Authorization (OWASP's #1 Risk)
Broken access control is #1 in the OWASP Top 10, and QA can catch most of these holes without a pentester. A first-person take: IDOR, horizontal and vertical privilege escalation, forced browsing, testing on the backend (not the UI), a role matrix, and token tampering. With a checklist and the usual places it breaks.