What is Broken access control?
When an application fails to enforce what an authenticated user is allowed to do or see, letting them reach data or actions meant for someone else.
Broken access control: When an application fails to enforce what an authenticated user is allowed to do or see, letting them reach data or actions meant for someone else.
In plain language
Broken access control is the #1 risk in the OWASP Top 10 (A01). It covers everything from viewing another tenant’s invoice (IDOR/BOLA) to performing an admin action as a regular user, to forced browsing to a hidden endpoint. The requests are individually valid — the failure is the missing check that this particular caller should be allowed.
It is the category signature scanners most reliably miss, because finding it requires a model of who should be allowed to do what. SuperPentest tests it by signing in as each identity you supply and replaying the same request as every role and tenant, then comparing what a control identity is denied against what a test identity is wrongly granted.
A concrete example
A SaaS dashboard serves GET /api/orgs/42/reports. A member of org 42 is meant to see it — but the server only checks that you are logged in, not that you belong to org 42. A user from org 99 swaps in another org’s id and pulls a stranger’s reports. The request is well-formed and returns 200; only a test that logs in as org 99 and asks for org 42’s data reveals the missing check.
Related
Access-control testing by replay → · IDOR testing → · BOLA testing →
Want this tested on your app? Book a demo or read how findings are verified.