Ask HN: Secure HttpOnly Cookie and CSRF Token and ACL and Rate Limiter. Enough?

About authentification and authorization: Let's assume I have implemented secure HttpOnly cookie -based session management, with a CSRF token and let's assume there is no vulnerability in my ACL (authorization) system, and I have a rate limiter to avoid brute force attacks. What's the most likely vulnerability I may face when it comes to reading or updating data a user is not supposed to? And how should I fix it?