Applications
Broken Access Control
The #1 OWASP category — missing or incorrectly implemented authorisation logic.
What it is
Broken access control occurs when an application does not correctly enforce what authenticated users are allowed to do. This includes horizontal privilege escalation (accessing another user's data by modifying an ID in the URL), missing function-level authorization (accessing admin endpoints without admin role), and insecure direct object references (IDOR). These vulnerabilities are introduced through business logic, not libraries — automated scanners miss most of them.
Attack techniques
- IDOR — Insecure Direct Object Reference
- Horizontal privilege escalation
- Forced browsing to unauthorised endpoints
- CORS misconfiguration
- JWT algorithm confusion
- Missing function-level access control
Business impact
An attacker can access, modify, or delete other users' data, escalate to administrative functions, or exfiltrate the entire dataset accessible to any user in the application.