thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Broken Access Control

OWASP Top 10 category (A01) for failures to enforce what authenticated or anonymous users are allowed to do.

Definition

Examples include IDOR, missing function-level checks, privilege escalation by parameter changes, CORS misconfiguration, forced browsing and, in 2025, SSRF. Mitigations are deny by default, centralized server-side authorization on every request, record ownership checks, and logging of access control failures.

Example

Changing /account?id=1001 to id=1002 shows another customer's account.

Exam tip

A01 in both 2021 and 2025; fix with server-side, deny-by-default authorization, never hidden UI elements.

Related terms