Broken Access Control occurs when applications fail to properly enforce restrictions on what users can access or modify. It is the most critical vulnerability in the OWASP Top 10.
By NextGen Securities • 15 min read
Access control ensures that users can only access resources they are authorized to use. Applications typically define roles such as admin, user, and guest.
Broken Access Control happens when these restrictions are not properly enforced, allowing attackers to access unauthorized data or perform restricted actions.
A website allows users to view their profile using:
If the system does not verify ownership, changing the ID:
This allows attackers to access another user's data.
Attackers may gain higher privileges by manipulating requests or bypassing checks.
Broken Access Control is one of the most critical vulnerabilities because it directly exposes sensitive data and system functionality. Proper authorization checks must be implemented across all application layers.