---
title: "Broken Access Control"
canonical: https://trickest.com/glossary/broken-access-control
description: "Broken access control lets users act outside their intended permissions, reaching data or functions that authorization checks should have blocked."
---

# Broken Access Control

Broken access control covers any case where the application fails to enforce what a user is allowed to do. The user authenticates fine, but the server trusts a request it should have refused: a regular account reaches an admin endpoint, one customer reads another customer's order, a hidden parameter flips a privilege flag. The authentication worked; the authorization did not.

The category is broad because access checks live everywhere and miss easily. Common patterns include changing an object ID in a URL to view someone else's record, forcing your way to a function the UI never showed you, and trusting a role claim the client can edit. [IDOR](/glossary/idor) is a frequent specific case, where the app keys access on a guessable identifier without confirming ownership.

This is the kind of flaw that ranks at the top of the [OWASP Top Ten](/glossary/owasp-top-ten), and it hits [API security](/glossary/api-security) hardest because APIs expose object references and actions directly to clients. Attackers also combine it with [CSRF](/glossary/csrf) to trigger privileged actions through a victim's session.

In a Trickest workflow, you enumerate endpoints and object IDs from crawling, then replay requests across different roles and tokens to flag any response that returns data the caller should never see.

---
_Markdown source of https://trickest.com/glossary/broken-access-control._