"The API endpoint exposes properties of an object that are considered sensitive and should not be read by the user."
The server returns the full database object. The frontend filters what it displays. The attacker skips the frontend and reads the raw API response — seeing every field the server sent, not just what the UI chose to show.
"The API endpoint allows a user to change, add, and/or delete the value of a sensitive object property which the user should not be able to access."
The server accepts all incoming JSON fields and binds them to the data model automatically. The attacker adds extra fields — isAdmin, role, balance — that get written to the database because nothing checked whether those fields should be writable.
Both failures are about the same missing check: does the calling user have permission to access this specific property? On a read, the answer is "don't send it." On a write, the answer is "don't accept it." The question is identical; only the direction differs.