Broken Access Control
Users can act outside their intended permissions - IDOR, missing function-level checks, forced browsing, tenant boundary bypass.
OWASP rank: 1
Practical checks
- Test every object reference cross-account (IDOR)
- Verify function-level authz on every privileged action
- Check for forced browsing to admin/internal routes
- Test all HTTP verbs, not just GET
- Confirm tenant isolation in multi-tenant apps