The application contains flaws in its business logic that allow users to perform actions or access functionality in unintended ways, bypassing intended workflow constraints.
An attacker could manipulate prices, skip payment steps, abuse discount codes, circumvent approval processes, or access premium features without authorization.
Review and document all business logic flows. Implement server-side validation for all business rules. Add integrity checks at each step of multi-step processes. Test all possible state transitions and edge cases.