Broken Access Control

What it is

Broken access control is the #1 web-app risk (OWASP A01). It occurs when the server does not (or insufficiently) enforce authorization, so a user reaches a resource, function or admin action they are not entitled to — commonly by changing an object ID, walking a list, or calling a hidden endpoint.

Why it matters

Unlike injection, access-control flaws are frequently logical, silent and hard to detect in SAST. They enable horizontal/vertical privilege escalation and large data exposures — and are a top route to breach.

How it works

• BOLA (object-level): request GET /invoice/123 after being authorized for 122 and receive 123 → object-level failure.
• Function-level: an unsanitized admin route reachable by any user.
• Missing policy: a UI that hides a button (but not a server-side check) is not control.

Detection

• Horizontal traversal using neighbor/serial IDs.
• 200/expected data on a request that should be 403/denied.
• Admin/function endpoints reachable in a normal user session.

Mitigation

• Enforce object-level and function-level authorization server-side on every request (see security:authentication-authorization, security:api-security).
• Deny by default; use random/non-guessable IDs where feasible; test with privilege-ladder cases (see security:code-review-static-analysis).

Investigation

Reproduce the traversal against the object/function map, confirm the missing check in code, scope which objects were accessible in logs, then patch and re-test the authorization matrix.