{
  "slug": "broken-access-control",
  "url": "https://www.infinity8labs.com/vulnerabilities/broken-access-control/",
  "title": "Broken access control & IDOR",
  "short": "IDOR",
  "aliases": [
    "Insecure direct object reference",
    "Broken object level authorization (BOLA)",
    "Missing function level access control"
  ],
  "summary": "The application checks who you are but not whether you're allowed to touch a specific record or function, so changing an ID or calling an endpoint directly exposes other users' data or admin actions.",
  "cwe": [
    "CWE-639",
    "CWE-285"
  ],
  "owasp": "A01:2021 Broken Access Control",
  "typical_severity": {
    "min": "medium",
    "max": "critical"
  },
  "updated": "2026-10-14",
  "references": [
    {
      "title": "CWE-639: Authorization Bypass Through User-Controlled Key",
      "url": "https://cwe.mitre.org/data/definitions/639.html"
    },
    {
      "title": "CWE-285: Improper Authorization",
      "url": "https://cwe.mitre.org/data/definitions/285.html"
    },
    {
      "title": "OWASP Top 10 A01:2021 Broken Access Control",
      "url": "https://owasp.org/Top10/A01_2021-Broken_Access_Control/"
    },
    {
      "title": "OWASP API Security Top 10 API1:2023 Broken Object Level Authorization",
      "url": "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/"
    },
    {
      "title": "OWASP Authorization Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html"
    },
    {
      "title": "OWASP Insecure Direct Object Reference Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html"
    }
  ],
  "sections": [
    "https://www.infinity8labs.com/vulnerabilities/broken-access-control/#overview",
    "https://www.infinity8labs.com/vulnerabilities/broken-access-control/#impact",
    "https://www.infinity8labs.com/vulnerabilities/broken-access-control/#examples",
    "https://www.infinity8labs.com/vulnerabilities/broken-access-control/#remediation",
    "https://www.infinity8labs.com/vulnerabilities/broken-access-control/#testing",
    "https://www.infinity8labs.com/vulnerabilities/broken-access-control/#references"
  ],
  "related_advisories": []
}