Broken Access Control
HighBroken Access Control
Definition
Broken Access Control covers every flaw where users can act outside their intended permissions. It includes horizontal privilege escalation (accessing data of other users with the same role) and vertical escalation (performing actions of a higher role). It is the #1 vulnerability in the OWASP Top 10 2021.
Impact
Access to other users' data and featuresEscalation to administrator accountsModification or deletion of other people's resourcesAccess to admin panels without authorizationBypassing payment or subscription restrictions
Examples
Vertical privilege escalation
The server checks that the user is authenticated but not their role. Any authenticated user can access administrator features simply by hitting the admin URLs.
# A normal user tries to access admin endpoints GET /api/admin/users HTTP/1.1 Authorization: Bearer <normal_user_token> # If the server only checks that there is a valid token # but not that the user has the admin role, # the normal user obtains the list of all users. # Other typically unprotected endpoints: DELETE /api/admin/users/123 PUT /api/admin/settings GET /api/admin/dashboard/stats
Horizontal escalation by parameter tampering
The server trusts the userId sent in the request body instead of deriving it from the authentication token. The attacker can perform actions on behalf of any user by changing this parameter.
# The frontend sends the userId as a body parameter
POST /api/orders
{"userId": "my-id-123", "productId": "prod-1"}
# The attacker changes the userId
POST /api/orders
{"userId": "other-id-456", "productId": "prod-1"}
# The server creates the order for other-id-456
# without checking that the body's userId matches the token's