What is a Broken Access Control vulnerability?
1 min read
Updated 2026-02-05
A vulnerability where users can access resources or perform actions beyond their intended permissions. Consistently ranks as the #1 web application security risk in OWASP Top 10.
Understanding Broken Access Control
Broken access control encompasses failures in enforcing proper restrictions on what authenticated users can do. This includes accessing other users' data, modifying access rights, or performing privileged actions. It moved to #1 in the OWASP Top 10 2021 because it's both prevalent and severe.
Examples
- Changing /user/123/profile to /user/124/profile to view another user's data
- Accessing admin functionality without admin privileges
- Modifying a hidden form field to change your user role
- API endpoints that don't verify the user owns the requested resource
How to Prevent
- Deny access by default
- Implement access control checks consistently across the application
- Use server-side validation for all access decisions
- Log access control failures and alert on anomalies
- Disable directory listing and ensure metadata files are not accessible
Worried about Broken Access Control in your app?
Our security audits identify vulnerabilities like this before attackers do. Get expert manual review of your codebase.