Broken access control is A01, the first entry, in the OWASP Top 10:2025. It is also easy to miss in generated code, because the code works perfectly when you test it as yourself.
Being signed in only says who someone is. Each request still has to check that this person may see or change this record. Looking a record up by the id in the URL, without checking its owner, lets any signed-in user read anyone's data by changing a number (CWE-639).
Hiding a button in the interface is not a check. Anyone can send the request the button would have sent. The server has to make the decision itself (CWE-602: client-side enforcement of server-side security).
Watch for code that copies the whole request body onto a record. If the record has a role or an is_admin field, the body can set it.