Broken Access Control.

Broken Access Control climbed to the #1 position in the OWASP Top 10 (2021), appearing in 94% of applications OWASP tested and mapping to 34 CWEs including CWE-284, CWE-639 and CWE-862 (Missing Authorization). It occurs when an application fails to consistently enforce who may do what — missing server-side checks, relying on hidden URLs (security by obscurity), trusting client-side role information, or exposing direct object references without ownership verification.

How it goes wrong

Authorization must be re-evaluated on the server for every request. The common failure is enforcing it only in the UI or at the gateway, then trusting the identifier the client sends. An attacker simply replays the request with a different object ID, role parameter, or HTTP method.

flowchart TD
  A[Request: GET /api/invoice/1043] --> B{Authenticated?}
  B -->|No| R[401 Reject]
  B -->|Yes| C{Ownership / role check<br/>enforced server-side?}
  C -->|Missing| L[Return invoice 1043<br/>even if it belongs to another tenant]
  C -->|Present| D{Does subject own<br/>or have role for object?}
  D -->|No| F[403 Forbidden]
  D -->|Yes| G[200 Return resource]
  L --> X[Broken Access Control:<br/>IDOR / data disclosure]

Real incidents

The First American Financial breach (2019) exposed roughly 885 million mortgage documents through a classic IDOR — sequential URLs required no authentication. The Optus breach (2022, Australia) exposed ~9.8 million customer records via an unauthenticated API endpoint. USPS Informed Visibility (2018) let any logged-in user query others' account data through an unprotected API.

Defences

Use centralised, deny-by-default authorization middleware; enforce ownership on every server-side action; prefer opaque or scoped identifiers; log access-control failures and alert on anomalies; disable directory listing; invalidate JWT/session scope server-side; and cover authorization paths with integration tests and continuous DAST rather than manual spot checks.