Broken Access Control
In modern web applications, protecting user data is a top priority. However, one of the most common and dangerous vulnerabilities is Broken Access Control. According to the OWASP Top 10, it consistently ranks among the most critical security risks.
Broken Access Control occurs when users can access resources or perform actions beyond their permissions, leading to serious data breaches and unauthorized activities.
What is Broken Access Control?
Broken Access Control is a security vulnerability where an application fails to properly enforce restrictions on what authenticated (or even unauthenticated) users are allowed to do.
Examples of Access Control:
- Normal user accessing only their profile
- Admin accessing all user data
- Restricting actions like delete, update, or view
When these rules are not enforced properly → Broken Access Control happens
How Does Broken Access Control Occur?
This vulnerability usually occurs due to poor implementation of authorization checks.
Common Causes:
- Missing role-based checks (RBAC failure)
- Insecure Direct Object References (IDOR)
- URL manipulation without validation
- Hidden endpoints not properly secured
- Client-side access control (trusting frontend only)
- Misconfigured APIs
Example of Broken Access Control
Scenario:
A user accesses their profile:
Attacker modifies the ID:
What happens?
- If no proper validation exists
- Attacker can view another user’s data
This is called IDOR (Insecure Direct Object Reference)
Admin Panel Example:
Normal user tries:
If access control is broken:
- User gets admin dashboard access
- Can modify/delete sensitive data
Advantages of Broken Access Control
- 🔓 Access to unauthorized user data
- 👑 Privilege escalation (user → admin)
- 🗂️ Data manipulation or deletion
- 🔍 Ability to enumerate users and resources
- 🔁 Full control over application functionality
Disadvantages
- Sensitive data exposure
- Unauthorized account access
- Financial loss and fraud
- Legal and compliance violations (GDPR, ISO 27001)
- Loss of customer trust
- System compromise
