🚪 Broken Access Control
The #1 web risk — reaching what you shouldn't⏱ ~2 min
Broken Access Control sits at the top of the OWASP Top 10 because it's both extremely common and extremely damaging. It means the application fails to properly enforce what each user is allowed to do or see.
Your hotel keycard should only open your room. Imagine if changing the last digit of your room number on the card let you into any room in the building. Broken access control is exactly this — the system checks that you're logged in, but fails to check that the specific thing you're asking for is actually yours.
Common Forms
| Type | What Happens |
|---|---|
| Insecure Direct Object Reference (IDOR) | Changing an ID in a URL (e.g., /invoice/123 → /invoice/124) shows someone else's data |
| Privilege escalation | A normal user performs admin-only actions |
| Missing function-level checks | Admin pages are 'hidden' but not actually protected — just knowing the URL grants access |
| Forced browsing | Reaching restricted pages by typing their URLs directly |
The IDOR Example Everyone Should Understand
You view your invoice at a URL ending in /invoice?id=1005. Out of curiosity you change it to /invoice?id=1006 — and you see another customer's invoice. The app checked that you were logged in, but never checked that invoice 1006 belonged to you. That's IDOR, a form of broken access control, and it's shockingly common.
You change /invoice?id=1005 to id=1006 and see someone else's invoice. This flaw is…