In CVSS version 3, there are four different attack vectors. I am not able to differentiate between local and physical.
Say, if I want to report "absence of logout button" I will use physical as access vector. In which cases can I use local as access vector? Please try to reference web application based vulnerabilities.
An issue of "absence of logout button" is absolutely not a physical vector. Physical means you have direct physical access to the server, as in you're standing right in front of it. A more appropriate one for "physical" would be a lack of full-disk encryption, since physical access in the context of server theft would result in an attacker getting hold of the data on the disk.
Local means you have a login session to the system. An example of such an issue might be a service binary with poor file permissions, allowing a local privilege escalation.
Adjacent means you're on the same network segment as the server, which is applicable for attacks such as ARP spoofing, where you need to be on the same subnet.
Remote, as the name suggests, is any case where you're on a remote network.
You should keep in mind that CVSS vectors are mostly not tailored for web applications; most if not all of your issues should be marked as remote vector.
