Issue Details
Broken Access Control
Aliases: None
Explanation
In OWASP 2003, A2 Broken Access Control combines related risk themes across Broken Access Control, Insecure Direct Object Reference (IDOR). Access control failures happen when users can perform actions or read data outside their allowed permissions. IDOR occurs when direct object references are not authorization-checked, exposing another user's resources. These weaknesses are often exploited as a chain: attackers start with weak input or trust boundaries, pivot through authorization or session gaps, and then move toward data exposure, integrity loss, or service disruption. Operationally, this can increase incident frequency, enlarge blast radius, and raise both remediation cost and compliance exposure when controls are missing or inconsistently enforced across services.
Remedy
For OWASP 2003 A2 Broken Access Control, apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Enforce server-side authorization on every request, deny by default, and validate object ownership before read/write actions. Never trust direct object IDs alone; enforce per-object authorization and use indirect identifiers where practical. Treat mitigation as a continuous program: define security requirements up front, enforce them in CI/CD gates, and verify effectiveness with threat modeling, code review, automated testing, and recurring penetration testing. Add monitoring and incident-response readiness so misconfigurations, abuse patterns, and control regressions are detected early and corrected before they become repeatable attack paths.
| Year | Rank | Category |
|---|---|---|
| 2003 | #2 | A2 - Broken Access Control |
| 2004 | #2 | A2 - Broken Access Control |
| 2007 | #4 | A4 - Insecure Direct Object Reference |
| 2010 | #4 | A4 - Insecure Direct Object References |
| 2017 | #5 | A5 - Broken Access Control |
| 2021 | #1 | A01 - Broken Access Control |
| 2025 | #1 | A01 - Broken Access Control |