YTYK You think you know

Card 7 of 18 Access, configuration and identity ●○○ Foundational

A01: still number one, and found everywhere

Broken Access Control holds #1. 100% of applications tested showed some form of it, and it has the highest number of occurrences in the contributed data. On average 3.73% of applications tested had one or more of its roughly forty CWEs.

Why it is like this

Access control is the one control that cannot be delegated to a library or a framework default: it encodes your domain's rules about who may do what, so every application has to implement it and every application can get it wrong.

Not to be confused with

Authentication. Authentication is who you are — A07. Access control is what you may do once you are in, and a correct login followed by an unchecked object reference is this category, not that one.

In practice

Its CWEs include exposure of sensitive information, CSRF, and — new to the category — SSRF.

Source: OWASP Top 10:2025 — A01:2025 Broken Access Control. Read on .

The OWASP Top 10:2025 is © 2021-2025 the OWASP Top 10 Team and is licensed under a Creative Commons Attribution 3.0 Unported Licence. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation.

Predict Check yourself

A logged-in user changes an id in a URL and sees another customer's invoice. Which category?

  1. A01 Broken Access Control — authentication succeeded; the authorisation check on the object did not happen.
  2. A07 Authentication Failures, because identity was involved.
  3. A06 Insecure Design, because the URL scheme was poorly designed.
  4. A02 Security Misconfiguration, if the endpoint was left public.
Show the answer

A01 Broken Access Control — authentication succeeded; the authorisation check on the object did not happen.

The boundary between A01 and A07 is exactly this: who you are versus what you may reach.