Broken Access Control
: A security vulnerability where an application fails to properly enforce restrictions on what authenticated users are allowed to do. This includes accessing other users’ data, modifying records without permission, escalating privileges, and bypassing access checks through URL manipulation or API tampering.
Why It Matters for AI-Coded Apps
Broken access control is the #1 vulnerability in the OWASP Top 10 for good reason. AI coding tools generate functional CRUD operations but rarely implement authorization beyond basic authentication. The code works correctly for the happy path but fails to check whether the current user should have access to the requested resource.
Real-World Example
An admin panel is protected by checking if (user.role === 'admin') on the frontend, but the API endpoints behind it have no authorization checks. Any authenticated user who discovers the API routes (e.g., DELETE /api/admin/users/123) can perform admin actions directly.
How to Detect and Prevent It
Implement authorization checks on every API endpoint, not just the frontend. Use middleware to enforce role-based access control (RBAC). Deny by default – require explicit grants. Implement row-level security for multi-tenant data. Log and alert on authorization failures.
Frequently Asked Questions
What is the difference between authentication and authorization?
Authentication verifies who you are (login). Authorization verifies what you’re allowed to do (permissions). A common mistake in AI-generated code is implementing authentication without authorization – the app knows who you are but doesn’t check if you should access a specific resource.
Why is broken access control #1 on the OWASP Top 10?
It’s the most common and impactful vulnerability category. It encompasses many specific issues (IDOR, privilege escalation, forced browsing, CORS misconfig) and is frequently missed because access control logic must be implemented manually in application code – frameworks can’t fully automate it.
How do I implement RBAC in my application?
Define roles (admin, user, viewer) and permissions (create, read, update, delete) for each resource. Create middleware that checks the user’s role against required permissions before executing the handler. Store role assignments in the database and verify on every request.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval