Broken Access Control
OWASP Top 10:2025 rank 1, still the most serious category. Covers IDOR, missing function-level checks, forced browsing, tenant bypass, and SSRF, which moved here from its own 2021 slot. OWASP's contributed data put one or more of 40 mapped CWEs in about…
OWASP rank: 1
Practical checks
- Replay object IDs across two accounts you control, including exports and batch routes
- Check function-level authorization on every privileged verb, not only GET
- Test tenant boundaries separately from user-to-user boundaries
- Treat a server-side fetch of a URL you influence as an access-control question: who is the server allowed to call?
- Confirm deny-by-default on non-public resources