Threat profile
Broken access control
The application checks who you are but not what you may do, so one user can reach another user's data or functions.
How it works
A typical case is a web address such as /invoice/1043: if the server returns invoice 1044 to a different signed-in user, the check is missing. The flaw is in the server's rules, not in the browser, so hiding a button does not protect anything.
What to look for
- One account successfully requesting identifiers that belong to others.
- Administrator functions reachable by direct address.
- Logs showing many sequential identifiers requested by one session.
What reduces the risk
- Enforce every permission on the server, for every request, with deny as the default.
- Check that the record belongs to the signed-in user, not only that a record exists.
- Add automated tests for each role and for cross-user access.
- Log access denials and alert on patterns.
Sources
Related threats
This section is for defence and learning. Do not test systems you do not own or have written permission to test: unlawful access to an information system is an offence (Turkish Penal Code, Article 243).