Broken Access Control

Broken access control is the top OWASP vulnerability category, covering failures that allow users to act outside their intended permissions. Vulnerabilities include insecure direct object references (accessing other users' resources by manipulating IDs), missing function-level access checks, privilege escalation, and CORS misconfigurations.

Consistent server-side access control enforcement on every request is the primary defense.