A01: Broken Access Control

What problem does it solve?

Broken access control lets attackers access data or actions beyond a user's authorization, exposing sensitive information and compromising operations.

Core Features & Use Cases

• Defines common broken access control patterns (privilege escalation, IDOR, insecure direct object reference) and remediation strategies for web applications.
• Provides risk and detection guidance for identifying and mitigating access-control weaknesses across software projects.
• Use Case: A security team's review of a web app to verify that authenticated users cannot access other users' resources or perform privileged actions.

Quick Start

Run a targeted access-control audit against your web application to detect and remediate privilege escalation and unauthorized resource access.