During a threat modeling session for a new customer-facing web portal, the security architect is mapping potential threats using the STRIDE framework. A team member notes that an attacker could present a forged session token to impersonate an authenticated user and access another customer's account data. Which STRIDE category does this threat represent, and which security property is being violated?