What is Broken Access Control?
Broken Access Control occurs when applications fail to enforce proper restrictions on authenticated users, allowing attackers to act outside their intended permissions. This can include viewing, modifying, or deleting data belonging to other users, or accessing admin functionalities without proper privileges.
🚪 Common Types of Access Control Failures
1. Insecure Direct Object Reference (IDOR)
Occurs when an attacker manipulates object identifiers in the URL or body (e.g., /profile?id=123) to access unauthorized resources.
2. Missing Function-Level Access Control
Occurs when backend routes are not protected by authorization checks, allowing unauthorized users to invoke them directly.
3. Forced Browsing
Accessing hidden or unlinked pages by guessing predictable URLs, like /admin or /config.
4. Privilege Escalation
Occurs when users gain higher privileges (e.g., user → admin) due to improper validation.
🧪 Real-World Example
Imagine a social media app where users can access their profile data via:
GET /api/user/profile?id=1001If an attacker changes the ID value to 1002 and accesses someone else's profile without restriction, this is a classic IDOR vulnerability.
🧠 Step-by-Step: Finding Broken Access Control
1. Analyze Roles and Resources
Understand what each user role should and shouldn't access. Compare actual behavior vs expected restrictions.
2. Tamper with IDs and URLs
Modify parameters like user_id, order_id, or file paths. Try accessing as another user or admin.
3. Check Hidden Functions
Access admin-only routes directly (e.g., /admin/delete-user) even if they are not visible in the UI.
4. Use Burp Suite's Repeater
Resend modified requests with elevated operations and observe server responses.
💡 Pro Tips & Practical Insights
- Test both authenticated and unauthenticated scenarios
- Use multiple user accounts with different privilege levels
- Automate parameter fuzzing using tools like
ParamMiner - Check for hardcoded role names or IDs in client-side JavaScript
- Look for backend API responses that reveal unnecessary data
🛡️ How to Prevent Broken Access Control
- Enforce server-side authorization checks for every sensitive action
- Avoid exposing internal object IDs directly to users
- Use access control middleware to manage roles and permissions
- Log access control failures and monitor for abuse patterns
- Apply the Principle of Least Privilege (PoLP) everywhere