Broken Access Control occurs when restrictions on authenticated users are not properly enforced, allowing them to access unauthorized functionality or data.
Common scenarios:
Vertical privilege escalation: Regular user accessing admin functions
Horizontal privilege escalation: User accessing another user's data
Missing authorization checks: Direct object references without validation
Example:
// Vulnerable URL
GET /api/user/123/profile
// Attacker changes user ID
GET /api/user/456/profile // Accesses another user's profile
Prevention:
Implement proper authorization checks
Use deny-by-default principle
Validate user permissions on every request
Use role-based access control (RBAC)
Log access control failures
Rewriting in plainer words…
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
