vuln-access-control

To detect IDOR and privilege escalation, you scan protected routes and verify object ownership and role checks. This identifies insecure direct object references and missing authorization across API and web endpoints.

Broken access control allows unauthorized data access by exploiting missing authz or IDOR. An automated scan finds it by mapping protected routes and testing authentication middleware to identify horizontal and vertical privilege escalation flaws.

To check for missing authorization on API endpoints, map routes protected by auth middleware and test role-based access control enforcement. This verifies ownership checks and flags endpoints lacking proper authorization constraints.

Yes, you can scan for horizontal and vertical privilege escalation by mapping protected routes and verifying role checks. The scan identifies improper role enforcement and appends vulnerability findings to a central report file.

You need a threat-model.md and recon.md file to run an access control scan. Providing the path to these files allows the scanner to map protected routes and append structured findings to your vulnerabilities.md file.

Access control vulnerability findings are reported as structured entries appended to ./assessment/vulnerabilities.md. This format consolidates IDOR and privilege escalation flaws into a central file for follow-up triage and remediation.