CyberGuard dictionary / Web Application Security
Broken Access Control
Broken access control is a failure to enforce which resources or actions an authenticated or anonymous user is allowed to use.
In simple terms
Being logged in does not mean a person should be able to see every record or use every function.
Technical explanation
Servers must check permissions for each relevant request, object, and operation. Failures include missing ownership checks, privilege escalation, forced browsing, and trusting user-controlled identifiers or roles.
Access control includes object ownership, roles, functions, and tenant boundaries. A client-side hidden button is cosmetic unless the server enforces the same restriction on direct requests.
Examples in practice
A regular customer changes an account ID in a request and reads another customer's statement because the server checks only that someone is logged in.
An ordinary user calls an administrator endpoint directly. The server denies the operation and records the attempt, even though the user can construct the URL manually.
Why it matters
Missing authorization can disclose data, alter records, or grant administrative powers.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.