Broken Access Control#

Broken Access Control is one of the most critical and prevalent web application vulnerabilities (ranked #1 in OWASP Top 10 2021 and 2025). It occurs when an application fails to properly enforce restrictions on what authenticated (or unauthenticated) users are allowed to do, allowing attackers to access resources, perform actions, or view data they should not be permitted to reach.

Fundamentals#

Insecure Direct Object References (IDOR)

  • Direct references to objects (user IDs, file names, database keys) in URLs, parameters, or APIs without proper ownership or authorization checks.
id=12
  • Allows horizontal privilege escalation (accessing another user’s data at the same privilege level).

Vertical Privilege Escalation

  • Low-privileged users (e.g., regular user) gaining access to high-privileged functions (e.g., admin panels, delete users, modify system settings).

Horizontal Privilege Escalation

  • Users accessing or modifying resources belonging to other users at the same privilege level (e.g., viewing another customer’s profile by changing an ID).

Missing Function-Level Access Control

  • Server fails to verify whether the authenticated user is authorized to execute a privileged function.
  • Administrative or sensitive endpoints remain accessible despite insufficient privileges.
  • Authorization is enforced only in the UI, not on the backend.
  • HTTP Method-Based Bypass
    • Authorization is applied to one HTTP method but missing for another.
GET  /admin/deleteUser  → 403 Forbidden
POST /admin/deleteUser  → 200 OK
  • Inconsistent Authorization
    • One endpoint correctly validates permissions, while another endpoint providing the same functionality does not.
  • Unprotected Secondary Functions
    • Export, import, backup, restore, bulk actions, or similar administrative operations lack authorization checks.

Other Common Classes

  • Parameter tampering (e.g., modifying role, isAdmin, userId, hidden fields).
  • Metadata manipulation (JWT claims, cookies, custom headers).
  • Context-dependent or workflow authorization bypasses.
  • Force browsing or direct access to hidden endpoints.

Attack Surfaces#

  • URLs and query parameters (e.g., /user/profile?id=123).
  • API endpoints (REST, GraphQL) especially object-level and function-level authorization.
  • Form fields, hidden inputs, and POST body parameters.
  • Cookies, JWT tokens, session headers, and custom headers.
  • File paths, static resources, and admin interfaces.
  • Multi-tenant applications (one tenant accessing another’s data).
  • Unprotected or predictable admin/privileged routes.

Exploitation#

Admin Panel Through URL Listing#

  • When a user gains access to functionality they are not authorized to use—such as accessing an admin panel—it is called Vertical Privilege Escalation.
  • For example any user can access their account by simply going to this URL https://example.com/login/user now one can access the admin panel if vulnerable to Broken Access Control like https://example.com/login/administrator
  • The url to admin panel can also hold some unpredictable address like /admin-ouvrouv3974v which is not predictable by a hacker
  • How ever hacker can directory brute-force or can inspect the website in order to find the unpredictable admin panel URL
  • A lots of times the