Broken Access Control Explained: The #1 Web App Risk (and How to Reduce It)

Broken Access Control is consistently ranked among the most dangerous web application risks because it can lead directly to unauthorized data access.

It’s also deceptively simple: the app works fine for normal users, but a small change in an ID, role, or endpoint can expose someone else’s data.

What “broken access control” means

Access control is the set of rules that decides who can do what. It breaks when the application fails to enforce those rules on every request.

Why this is a business problem

• Customer data exposure (one user accesses another user’s records)
• Integrity failures (orders, billing, or content can be modified)
• Regulatory and contractual risk if PII is exposed
• Trust collapse (customers assume the platform is unsafe)

Common patterns that cause access control failures

• IDOR (Insecure Direct Object Reference): changing ?id=123 to ?id=124 exposes another user’s data.
• Missing authorization checks on API endpoints.
• Role/permission confusion: “admin-only” features reachable by normal users.
• Client-side enforcement: hiding buttons in UI but not enforcing on server.
• Multi-tenant mistakes: tenant boundaries not enforced in queries.

High-signal places to review first

• User profile and account endpoints
• Invoices, orders, downloads, and documents
• Admin panels and “internal tools”
• APIs that accept IDs (user_id, order_id, tenant_id)

Practical prevention checklist

1. Enforce authorization server-side on every request (not in the UI).
2. Use “deny by default” permission models.
3. Check ownership (resource belongs to requesting user/tenant) before returning data.
4. Use scoped tokens and least privilege.
5. Log and alert on suspicious access patterns (e.g., many IDs requested rapidly).

How to verify exposure quickly

Run a scan to catch obvious exposed endpoints and risky patterns, then prioritize fixes that could expose customer data.

Scan here: https://scanner.skilledscan.com

FAQ

Is this only a SaaS problem? No. Any site with accounts, orders, documents, or admin features can have broken access control.

What’s the first thing to fix? Any endpoint where a user can access another user’s data by changing an ID.