Broken access control: when users reach what they shouldn't

Access-control weaknesses are about what a user is allowed to do once they are on your site — and they are among the most common serious flaws found in real-world testing.

Broken access control shows up as things like:

• An ordinary user reaching admin-only pages or functions.
• One user viewing or editing another user's data by changing an identifier in a URL or request.
• Restricted actions that are hidden in the interface but not actually enforced on the server.

These flaws are dangerous because the site often looks secure — the forbidden options simply aren't shown — while the underlying checks are missing. Automated scanners struggle to spot them because understanding who should be able to do what requires human judgement. A manual tester deliberately tries to step outside their permitted role, and the report details anywhere they succeeded.