BROKEN
ACCESS CONTROL

Access control is the set of rules that decide who can do what inside a system. Broken access control means those rules are either missing, wrong, or only enforced in the wrong place.

The most common mistake: putting role checks in the browser (hiding buttons, greying out menus) instead of on the server (checking the role before processing any API request).

The browser is something the attacker controls. They can call any API endpoint directly — no button click required. If the server does not check, it responds.

Forced browsing:
Navigate directly to a URL the application never showed you: /admin/dashboard, /api/admin/users. If no server check exists — you get in.

Privilege escalation via parameter tampering:
Change role=viewer to role=admin in a request. If the server trusts the client-supplied role — you are now admin.

IDOR (Insecure Direct Object Reference):
Change /api/records/42 to /api/records/43. If no ownership check — you read someone data.

Missing function-level access control:
A feature exists in the API but is hidden in the UI. Call the API endpoint directly — it works for any authenticated user regardless of role.

HTTP method tampering:
The GET endpoint checks roles. The POST endpoint to the same URL does not. Use POST instead of GET to bypass the check.

The correct fix — server-side role verification on every endpoint:
Every API endpoint checks the authenticated session role before processing the request. Middleware approach: a single function wraps every protected route and returns 403 Forbidden if the role does not match.

Code example (Node.js middleware):
function requireRole(role) {
  return (req, res, next) => {
    if (req.session.role !== role) return res.status(403).json({error: 'Forbidden'});
    next();
  };
}
app.post('/api/admin/transfer', requireRole('admin'), handler);

Defence in depth:
Log all access denials — they indicate probing
Rate limit repeated 403 responses from the same IP
Use an allowlist approach: default deny, explicitly allow
Regular access control audits — check every endpoint

Notable CVEs:
CVE-2019-5736 — runc container escape, broken access to host
CVE-2021-41773 — Apache HTTP Server path traversal, CVSS 9.8
CVE-2022-0492 — Linux cgroups privilege escalation