What Is Broken Access Control?

Broken access control happens when an application fails to properly enforce rules about who can access what. This means users can reach parts of the system, data, or features they are not supposed to see or use.

How Does It Allow Unauthorized Access?

When access control is broken:

• Attackers can view private information they should not see;
• Users can perform actions that are supposed to be restricted, like deleting data or changing settings;
• Unauthorized users can access admin areas or sensitive functions.

This can lead to data breaches, loss of sensitive information, or even full control over the application by attackers.

Common Broken Access Control Issues

Broken access control happens when an application fails to properly restrict what users can see or do. Here are the most common issues you will encounter:

• Missing access checks: the application does not verify whether a user is allowed to perform a certain action or access specific data;
• Insecure direct object references (IDOR): users can access data or resources by guessing or manipulating identifiers (like user IDs or file names) in the URL or request, even if they should not have permission;
• Privilege escalation: users can gain higher levels of access than intended, such as a regular user gaining admin rights by exploiting flaws in how permissions are enforced.

These issues can allow attackers to view sensitive information, modify data, or perform unauthorized actions. Always ensure your application checks every request to confirm the user has the right permissions before granting access.