In OWASP 2003, A2 Broken Access Control combines related risk themes across Broken Access Control, Insecure Direct Object Reference (IDOR). Access control failures happen when users can perform actions or read data outside their allowed permissions. IDOR occurs when direct object references are not authorization-checked, exposing another user's resources. These weaknesses are often exploited as a chain: attackers start with weak input or trust boundaries, pivot through authorization or session gaps, and then move toward data exposure, integrity loss, or service disruption. Operationally, this can increase incident frequency, enlarge blast radius, and raise both remediation cost and compliance exposure when controls are missing or inconsistently enforced across services.
For OWASP 2003 A2 Broken Access Control, apply defense in depth across design, implementation, deployment, and operations rather than relying on a single control. Priority controls include: Enforce server-side authorization on every request, deny by default, and validate object ownership before read/write actions. Never trust direct object IDs alone; enforce per-object authorization and use indirect identifiers where practical. Treat mitigation as a continuous program: define security requirements up front, enforce them in CI/CD gates, and verify effectiveness with threat modeling, code review, automated testing, and recurring penetration testing. Add monitoring and incident-response readiness so misconfigurations, abuse patterns, and control regressions are detected early and corrected before they become repeatable attack paths.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2025Latest
#01A01 Broken Access Control
No change since 20212021
#01A01 Broken Access Control
↑ Up 4 since 20172017
#05A5 Broken Access Control
↑ Up 3 since 20102010
#08A8 Failure to Restrict URL Access
↑ Up 2 since 20072007
#10A10 Failure to Restrict URL Access
↓ Down 8 since 20042004
#02A2 Broken Access Control
No change since 20032003
#02A2 Broken Access Control
