Broken Access Control Explained (OWASP A01) for Bug Hunters
Broken access control is OWASP’s top web risk for a reason. Apps constantly answer the wrong question:
They ask “are you logged in?”
They forget to ask “are you allowed to do this?”
This article translates A01 into hunter language.
Quick takeaway: Authentication proves identity. Authorization proves permission. Most bounty jackpots live in the gap between those two.
What it looks like on real targets
- IDOR / BOLA on APIs
- Vertical privilege escalation (
role=user→ admin features) - Forced browsing to hidden admin routes
- Missing function-level checks on export, delete, share
- CORS or cache mistakes that leak authenticated data
A field checklist you can reuse
- Map roles: guest, user, elevated user, admin
- For each sensitive action, try a lower role
- Swap object IDs between two users
- Call admin JSON endpoints with a normal session
- Try HTTP method overrides and alternate routes to the same function
- Check mobile/API clients for extra methods the web UI hides
How to write the impact sentence
Weak: “Missing access control.”
Strong: “A normal user can download any customer invoice by changing invoice_id.”
Programs pay for the second sentence.
Fixes that belong in every report
- Deny by default
- Central authorization checks per object and per function
- Automated role tests in CI
- Log and alert on repeated authorization failures
Original Bugflare article. Framed around the OWASP Top 10 Broken Access Control category. Use only authorized testing accounts.