A01: Broken Access Control · 2021

The application fails to enforce what each identity can read, modify or execute

Summary

The application fails to enforce what each identity can read, modify or execute. This includes access to other users' objects, administrative functions and internal resources.

How the attack works

A user changes an object identifier in the API; the server skips authorization and returns another person’s data.

Example

Vulnerable · Pseudocode

GET /api/invoices/1043
Cookie: session=alice
return invoices.find(id)

Fix: Check on the server that the invoice belongs to the session user.

Prevention

Deny by default and verify authorization on the server for every operation.
Centralize access rules and check resource ownership or membership.
Test controls with different users, roles and tenants.

Lineage

2013 · A4: Insecure Direct Object References Merged into Broken Access Control
2013 · A7: Missing Function Level Access Control Merged into Broken Access Control
2017 · A5: Broken Access Control Moves up to rank 1 in 2021
2021 · A01: Broken Access Control Moves up from A5:2017
2021 · A10: Server-Side Request Forgery (SSRF) New in 2021
2025 · A01: Broken Access Control Consolidates SSRF and remains at rank 1

2013:A4 → 2017:A5: IDOR is integrated into Broken Access Control.
2013:A7 → 2017:A5: Missing Function Level Access Control is integrated into Broken Access Control.
2017:A5 → 2021:A01: Broken Access Control moves up from rank 5 to 1.
2021:A01 → 2025:A01: Broken Access Control remains at rank 1.
2021:A10 → 2025:A01: SSRF is consolidated into Broken Access Control.

Sources

Open official source ↗

Buy me a coffee