Broken Access Control
Broken access control is missing or bypassable authorization checks that let users perform actions or access resources they are not entitled to.
Purpose
To understand the privilege escalation caused by authorization flaws and their defenses; it is the #1 vulnerability in the OWASP Top 10 2021.
Mechanism
Flaws include forced browsing (directly accessing /admin), IDOR, missing function-level checks, HTTP method bypass, and JWT role tampering. Defenses: server-side authorization checks, deny by default, centralized policy.
Use cases
- Authorization security audit
- Privilege escalation defense
- Access control design