Broken access control: the finding we expect to look for first

Broken access control means a user can do something they should not be allowed to do. It sits at the top of the OWASP Top 10 (2021 edition), and automated tools find it poorly, because they do not know who should see what.

What it looks like

• Changing an identifier in the address (/invoice/1041 to /invoice/1042) shows someone else's invoice.
• A normal user calls an administrator function directly and it works.
• A hidden button is hidden only in the interface, while the server accepts the request anyway.

Why it happens

The check was written in the screen, not on the server, or it was forgotten on one of dozens of endpoints.

What helps

1. Enforce permissions on the server, on every request.
2. Deny by default, and allow explicitly.
3. Test with at least two accounts per role, trying to cross between them.

This is the test grey box approaches do well, and one reason we ask for accounts.