Understanding API Broken Access Control: A Beginner's Guide

In the world of web application security, few threats are as dangerous — and as overlooked — as Broken Access Control (BAC). It isn't as flashy as SQL injection or as trending as zero-days, but when access control breaks down, the entire system can unravel. At its core, BAC happens when a system fails to properly enforce who can do what. The result? Users gain access to data or actions they were never meant to have.

What is Broken Access Control?

Access control is how a system determines what resources a user is allowed to access or modify — the digital equivalent of having the right key for the right door. Broken Access Control occurs when:

• Users can perform actions outside of their intended permissions.
• Access restrictions can be bypassed or are missing altogether.
• Roles and ownership aren't properly validated by the backend.

These flaws don't just lead to bugs — they open the door to data leaks, privilege escalation, and full system compromise.

Scenario: A Hidden API with a Simple Flaw

A company's web application includes a hidden API designed exclusively for two high-profile users, Billy and Kyne, to perform specific administrative tasks. The API is accessed via a POST request:

POST /api/admin/reports

The functionality doesn't appear in the user interface, making it seem secure. However, there is a critical oversight: the application does not check whether the user making the request is actually Billy or Kyne. Any authenticated user can call this endpoint and execute these restricted tasks.

How the vulnerability unfolds

• Discovery: A curious user 'Alex' notices unusual traffic in the browser's developer tools, or intercepts requests using tools like Burp Suite, uncovering the hidden endpoint.
• Fuzzing the Endpoint: Alex crafts requests, adjusting headers and payloads. The server responds positively and grants access to reports meant only for Billy and Kyne.
• Data Extraction: Alex automates requests via a script, downloading sensitive data never intended for their access.
• No UI, No Problem: Tools like Postman or cURL let Alex interact directly with the API, bypassing the front-end entirely.

Why This Happened

• The API endpoint does not validate the user's role or permissions before processing the request.
• The application relies solely on obscurity — the absence of a UI — to protect the endpoint, assuming users wouldn't discover or reach it.

Types of Privilege Escalation

1. Vertical Privilege Escalation

"User becomes admin."

This occurs when a lower-privileged user gains access to functions or data reserved for higher-privileged roles — for example, a regular user reaching admin dashboards via direct URL manipulation, or an API that fails to validate roles allowing normal users to perform admin actions such as deleting accounts or changing system settings.

Impact: Total loss of system control. Attackers can override permissions, exfiltrate sensitive data, or disrupt operations.

2. Horizontal Privilege Escalation

"User becomes another user."

This involves a user accessing resources belonging to another user at the same privilege level — for example, changing a user_id in a URL to access another person's profile, orders, or messages, or downloading someone else's invoice by guessing the file path.

Impact: Data leakage, privacy violations, and unauthorised transactions — especially dangerous in healthcare, finance, or education applications where sensitive personal data is involved.

Real-World Consequences

• Compliance Violations: Exposing personal or financial data can attract regulatory fines under GDPR, HIPAA, or PCI-DSS.
• Brand Damage: Users lose trust when their data is compromised.
• System Takeover: Attackers can chain horizontal and vertical escalation to completely take over the application.

Why Does BAC Happen?

1. Lack of Role Validation

Applications fail to verify the roles or privileges of users before allowing access to sensitive resources. An API endpoint meant for administrators may not check if the requester holds admin privileges, letting any authenticated user through.

2. Over-Reliance on Client-Side Enforcement

Access controls implemented on the client side — in JavaScript or HTML — can be bypassed by directly manipulating requests. Hiding a button from unauthorised users is not the same as protecting the endpoint it calls.

3. Improper Endpoint Security

API or web endpoints that rely on obscurity rather than authorisation checks remain accessible to anyone who discovers them via developer tools, traffic interception, or fuzzing.

4. Failure to Implement the Principle of Least Privilege

When users are granted broader access rights than necessary, the blast radius of any access control failure grows. A user with read-only intent should never hold write or execute privileges.

5. Inadequate Testing and Security Reviews

QA that focuses only on UI functionality will miss back-end authorisation vulnerabilities on hidden APIs and rarely used features.

How to Prevent Broken Access Control

1. 1Deny by default — only allow access to authenticated and authorised users.
2. 2Implement role-based access control (RBAC) on the server side — never trust the front-end.
3. 3Validate ownership of every object before showing or modifying it.
4. 4Test for privilege escalation using role-switching and IDOR testing.
5. 5Log and monitor access attempts — flag and block unusual activity.

Conclusion

Broken Access Control is the #1 issue in the OWASP Top 10 2021 for a reason. Whether it's horizontal or vertical privilege escalation, the cost of ignoring it is high. Developers must assume users will try to break the rules and build systems that enforce permissions strictly and consistently on the backend.

"Security isn't about trusting users — it's about verifying limits. Always."