Broken access control
Summary: PortSwigger Research describes access control as the constraints on who or what is authorized to perform actions or access resources, and states that broken access controls often present a serious security vulnerability. The text notes that such flaws can allow attackers to access resources or perform actions they should not be able to, and advises implementing access controls that enforce restriction to authenticated users where an endpoint is intended to be limited.
Why it matters: A broken access control flaw lets an attacker reach resources or perform actions outside their authorization, so the exposure is defined by what the endpoint allows rather than by what the attacker was meant to see.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026