Broken Access Controls occur when an application fails to properly enforce restrictions on what authenticated users are allowed to do or which resources they can reach. Access control is the mechanism that ensures each user can only perform the actions and access the data appropriate to their permissions. When these controls are missing, misconfigured, or improperly implemented, users can act outside their intended privileges – viewing, modifying, or deleting data they should not touch, or performing operations reserved for others.
This is one of the most critical and widespread categories of security weakness. It ranked at the top of the OWASP Top 10 for web applications, and it underlies several of the most serious API risks. Broken access control is the umbrella under which more specific failures sit, including Broken Object Level Authorization (BOLA/IDOR), where a user accesses another user’s object by manipulating an identifier, and Broken Function Level Authorization (BFLA), where a user invokes privileged functions they should not be able to reach.
Common causes include relying on the client to enforce restrictions (which attackers simply bypass), failing to verify ownership of a requested resource on the server, exposing privileged functionality without proper role checks, and insecure direct references to objects. Because APIs expose data and functions directly and often handle authorization per request, they are especially prone to broken access control – an endpoint may authenticate that a user is logged in but fail to verify that this particular user is entitled to this particular resource or action.
The consequences are severe: unauthorized data access, data tampering, privilege escalation, and full account or system compromise. Preventing broken access controls requires enforcing authorization on the server side for every request, checking ownership at the object level, denying by default, applying least-privilege principles, and testing access control logic thoroughly. Because these flaws stem from business and authorization logic rather than obvious code bugs, they are frequently missed by generic scanners and require careful design and dedicated testing.