Broken Access Control
Broken Access Control is a vulnerability where an application fails to properly enforce what an authenticated user is allowed to do or see, letting attackers access other users' data, perform privileged actions, or bypass permission checks they should not be able to reach.
Broken Access Control occurs when an application does not correctly restrict actions and resources to the users authorized for them. Unlike authentication (proving who you are), access control governs what you may do. When those checks are missing, incomplete, or enforced only in the UI, a user can escalate privileges, view or modify records belonging to others, or invoke administrative functionality by simply changing a URL, parameter, or API request.
Common patterns include insecure direct object references (guessing or altering an id to read another account's data), missing function-level authorization on admin endpoints, forced browsing to protected pages, metadata tampering such as replaying or modifying JWTs, and CORS misconfigurations that expose APIs cross-origin. The root cause is usually enforcing access decisions on the client side or trusting request-supplied values instead of checking ownership and role on the server for every request.
Broken Access Control is ranked the number one risk in the OWASP Top 10 (2021) and maps to CWE-284 and related weaknesses. It matters because these flaws are high-impact and hard to detect with generic tooling — they depend on application-specific authorization logic. Developers should deny by default, enforce checks server-side on every request, and verify object ownership rather than relying on unguessable identifiers.