Home / Knowledge hub / Broken access control
Knowledge hub
Broken access control
An application failing to enforce its own rules about who may do what.
What it means
Broken access control is the general name for an application that fails to enforce its own rules about who may see or do what. The rules exist, usually written down somewhere. The code simply does not check them on every path.
Four shapes cover most of it. Reading another customer's record. Opening an administrative page as an ordinary user. Changing a field you were only meant to read. Keeping access after somebody removed it.
Why it matters
It sits at the top of the OWASP Top 10 because it is common and immediately expensive. No exploitation step can go wrong, so one request separates a flaw from data leaving. Because the traffic looks ordinary, teams usually measure discovery in months.
Automation struggles with it too. A tool with a single login sees that a page exists, but not that a different role should never have reached it. A clean scan and a serious flaw coexist quite comfortably. Two logins change that. A better rule set does not.
How it shows up
The tell is a check made in the wrong place. In the interface rather than on the server. At the start of a flow rather than at each step. On the type of user rather than on the specific record.
Features built in a hurry for one large customer deserve a second look. So do exports, search and bulk endpoints, where a filter on screen often does work a server check should be doing.
Testing it means logging in as every role and trying every door from each one. See the authorisation matrix.
Questions people ask
Broken access control, answered
How do we prove to the team that this is a real problem?
Show the request and the response. A screenshot of somebody else's record, beside the account that asked for it, ends the argument in a way a severity rating never does.
That is deliberately how we report. The request, the response, a screenshot and the line of code that allowed it, so nobody has to take a rating on trust.
What is the difference between a missing check and privilege escalation?
The missing check is the flaw. Privilege escalation is what somebody does with it, moving from the access they hold to access they should not.
Vertical means reaching a higher role, such as an ordinary user opening an administrative page. Horizontal means reaching a peer's data at the same level. Both start from the same absent line of code.
Each customer gets their own subdomain. Does that keep them apart?
Only if the server checks the subdomain on every request, and most do not. The name in the address bar is a label. Behind it sits one application and usually one database.
Test it the dull way. Log in as customer A, take a request, change the identifier to something belonging to customer B, and read what comes back.
Where is the safest place to host our admin panel?
Anywhere you like, provided the server checks the role on every request behind it. A separate address, an odd path or an internal domain are conveniences rather than controls.
Limiting it to your office network or a company VPN is a sensible extra layer. Never make it the only one, because one compromised machine inside then inherits the whole panel.
A report says we have broken access control. How do we fix it?
Find every path that reaches the data, not only the one in the report. Add the check in the code that does the work, against the specific record, then remove any interface hiding that was standing in for it.
Then retest as each role. We will be straight with you here: we do not confirm your fix for you today. Prove-the-fix ships on 16 November 2026.
Related
Terms that sit next to this one
Access control
The rules deciding which person can see or do which thing in your app.
Authorization
Deciding what a proven user is then allowed to do.
IDOR
Changing an id in a request and getting back someone else's record.
BOLA
An API returns a record just because you asked for it by number.
Privilege escalation
Gaining rights you were never given, sideways or upwards.
Top of the OWASP list. Tested?
Broken access control is common and quiet. We log in as every role, try every door between them, and prove each finding with the request and the response it returned. Ask about your app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.