Skip to content
Kodesec × Integrated-Systems.ai
KODESEC
Book a call

A01 · OWASP Top 10 · 3 min

Broken access control. Who can open what on your site?

Your website knows who someone is. This is what happens when it forgets to check what they're allowed to see or change.

I run a

In 10 seconds

Signed in is not the same as allowed.

What it is

The site checked who you are, but not what you're allowed to open. Logging in is not the same as being allowed.

Why you care

One customer could see or change another's orders, or reach staff-only tools. It ranks number one on OWASP's Top 10 list of web risks.

What to do

Ask your developer a few questions, and decide who may do what. Both are below.

For your business

What's at stake for you.

I run a

Who is affected

Your customers, and anyone who trusts you with their details.

What could leak

Names, addresses, phone numbers and purchase history.

Ask this first

“For every screen after login, where is the rule that stops one user reaching another's data?”

Where it hides

Pick a part of your website.

Each one is a place where the site must check permission.

yourbusiness.com/orders/1001
What's here
Each customer sees their own orders. Each item has its own page.
What goes wrong
The page address contains a number. If the site never checks whose order it is, changing the number can show someone else's.
Ask your team
When a customer opens a order, does the server check it's theirs?
Developers call it
IDOR (Insecure Direct Object Reference)

What it costs

The flaw is small. The fallout isn't.

Trust

Customers forgive slow sites, not strangers seeing their details.

Legal

Data-protection and reporting duties vary by country and sector. Ask a legal adviser.

Cleanup

Investigation, fixes, telling people, handling complaints.

Fraud

If records can be edited, not just seen, attackers can redirect, refund or alter.

For an online shop: what could be seen is names, addresses, phone numbers and purchase history. What could be changed: cancel or redirect orders, change prices, trigger refunds.

Does this apply to you?

Tick what's true. Get your questions.

First

So the questions fit you

What kind of business do you run?

A real case

It happens to large, careful companies.

First American Financial, 2019

A document link that worked for anyone who changed a number.

What it cost
The US SEC later charged the company over how it handled the disclosure, with a penalty of $487,616.
The lesson
A link is a door. Every door needs its own check.
Read the full story and sources

Documents on the US title insurer's website could be opened through an address containing a sequential number. Journalist Brian Krebs reported in May 2019 that changing the number showed other customers' documents, and that around 885 million records were exposed.

The US SEC later charged the company over how it handled the disclosure, with a penalty of $487,616.

Also: in 2018 Krebs reported that a USPS service for business mailers let any logged-in user look up other users' account details. USPS said it found no evidence of misuse and fixed it. Sources: Krebs on Security, US SEC.

Your part

Three decisions that are yours.

  1. 01Who may do whatWrite down what each role can see and change. Developers build it, but can't invent your rules.
  2. 02Independent testingHave someone who didn't build the system test it, before launch and after big changes.
  3. 03One ownerName one person accountable for access rules.
For your developer: the technical layer
  • Also called IDOR, BOLA and privilege escalation, depending on the form.
  • Deny by default. Check permission on the server, on every request, for every object.
  • Scope database queries by user or tenant, so wrong rows are never returned.
  • Unpredictable IDs help, but never replace the check.
  • Test with two accounts of each role, and review every API endpoint, old versions included.
  • Log refused attempts and alert on patterns. Scanners miss these flaws because they don't know your rules.

Remember

Three things to keep.

  • Logged in is not the same as allowed. The site must check both, every time.
  • Who may see what is a business decision. Write it down.
  • The damage depends on what's behind the door, so start with your most sensitive data.

What OWASP says

The essentials, slide by slide.

A01 · owasp top 10 · 01/04

OWASP Top 10 · A01

broken access control

Source: OWASP Top 10:2025 (CC BY 3.0) ↗

OWASP is a non-profit that publishes the industry's standard list of web risks. Safety measures adapted from the OWASP Top 10:2025 (CC BY 3.0). The people and businesses in the examples are made up.