Haxoris Wiki

A01: Broken Access Control

Broken Access Control is a critical security risk that occurs when applications fail to enforce proper authorization, allowing attackers to access, modify, or delete sensitive data and perform unauthorized actions. These vulnerabilities arise when restrictions on what authenticated users can do are not correctly implemented, leading to data breaches, privilege escalation, and system compromise. Attackers exploit these flaws by bypassing access controls through parameter manipulation, forced browsing, or privilege escalation techniques. In the OWASP Top 10:2025 this category also absorbs Server-Side Request Forgery (SSRF), which is a failure to control which resources the server itself is allowed to reach.

Common Vulnerabilities:

  • Insecure Direct Object References (IDOR)
  • Missing or Weak Authorization Checks
  • Privilege Escalation (Horizontal & Vertical)
  • Forced Browsing (Accessing Hidden Endpoints)
  • Path Traversal and Local File Inclusion
  • Improper Session Handling
  • Bypassing Access Controls via Parameter Manipulation
  • Server-Side Request Forgery (SSRF) Reaching Internal Services or Cloud Metadata
  • Cross-Site Request Forgery (CSRF)

To mitigate these risks, applications should enforce role-based access control (RBAC), implement least privilege policies, validate permissions on every request, use secure indirect object references, restrict which destinations the server may request, and regularly test access controls to prevent unauthorized access.

In this section

Last updated

References