What is broken access control?

Broken access control is any flaw that lets a user act outside their intended permissions: read another user's data, change records they do not own, or reach admin functions. It is the first category of the OWASP Top 10:2025, A01, and covers IDOR, missing role checks, forced browsing and server-side request forgery.

Why it matters

Access control is the code that answers 'may this user do this, to this object, right now?'. Unlike injection, there is no dangerous character to filter and no library that fixes it for you: the rules come from your business, so only your code can enforce them. A scanner can flag a suspicious response, but it rarely knows that user 7 should never see invoice 1042.

The OWASP Top 10:2025 keeps it in first place and folds server-side request forgery into it. The consequences range from one leaked profile to a full takeover, when the missing check sits on an endpoint that changes roles or passwords.

Example: an admin path that does not check who is asking

CyberGym, the legal practice target, has a route under /rest/admin/. A request without any session still gets an answer:

$ curl -s https://cybergym.hackergpt.app/rest/admin/application-version
{"version":"19.1.1"}

Here the leak is small, a version number, but the pattern is the one that matters: the path says admin and the code does not check. The same app answers 401 to an anonymous request for /api/Users, so the check exists elsewhere and is missing here. Inconsistency like that is typical of broken access control, because each route gets its own check, written by hand.

To look for it on your own site, list your routes and endpoints with the role each should require, then call each one as an anonymous visitor, as a normal user and as a second normal user. Every cell where the answer differs from the table is a finding.

Common mistakes

  • Enforcing roles in the interface only. Hiding the admin menu is a convenience. The server must refuse the request itself.
  • Allowing by default. Deny unless a rule allows, so a forgotten route fails closed instead of open.
  • Checking the role but not the object. A normal user may edit orders, but only their own. That second check is IDOR territory.
  • Testing as one user. Access-control bugs appear between accounts and roles, so test with several.

Related terms

Go deeper

Sources

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.