Attackers often try to access functions or data of web applications which are only available to a limited group of users. If authorisation is implemented improperly, in some circumstances an attacker could obtain the authorisations of another user with more comprehensive rights and thereby access protected areas and data. This can occur when an attacker deliberately manipulates their own input data, for example.