Browse / Access Control

Access Control

See it on the mapBypass libraryPayloads

Weaknesses in this class

• Improper Access Control - Generic888
• Privilege Escalation464
• Improper Authorization55
• Client-Side Enforcement of Server-Side Security20
• Forced Browsing14
• Incorrect Authorization13
• Reliance on Untrusted Inputs in a Security Decision8
• Improper Privilege Management7
• Missing Authorization7
• Improper Handling of Insufficient Permissions or Privileges4
• Incorrect Permission Assignment for Critical Resource3
• Execution with Unnecessary Privileges3
• Improper Export of Android Application Components2
• Incorrect Privilege Assignment2
• Incorrect Default Permissions2
• Access Control Check Implemented After Asset is Accessed1
• Improper Preservation of Permissions1

Often found together with

• Information Disclosure209
• Misconfiguration200
• Authentication179
• Insecure Direct Object Reference104
• Cross-site Scripting72
• Code Execution70
• Cross-Site Request Forgery61

Most upvoted Access Control reports

AllValidInformativeN/ADuplicate

1. Enable 2FA without verifying the emailDuplicateImproper Access Control - Generic · low · XVIDEOS
   70 votes
2. Privilege Escalation by abusing non-existent path. (Windows)DuplicatePrivilege Escalation · medium · PortSwigger Web Security
   59 votes
3. Full account takeover of any user through reset passwordDuplicateImproper Access Control - Generic · critical · UPchieve
   54 votes
4. [HTA2] Authorization Bypass on https://██████ leaks confidential aircraft/missile informationDuplicateImproper Authorization · critical · U.S. Dept Of Defense
   40 votes
5. Reset the 2FA of the user which can lead to Account TakeoverDuplicateImproper Access Control - Generic · medium · HackerOne
   37 votes
6. Bypassing Two-Factor Authentication via Account Deactivation and Password ResetDuplicateImproper Access Control - Generic · HackerOne
   33 votes
7. Oauth Misconfiguration Lead To Account TakeoverDuplicateImproper Authorization · medium · Reddit
   21 votes
8. PI leakage By Brute Forcing and Phone number deleting without using passwordDuplicateImproper Access Control - Generic · medium · X / xAI
   16 votes
9. xmlrpc.php file enabled - data.govDuplicateImproper Access Control - Generic · medium · GSA Bounty
   10 votes
10. Huge amount of Subdomains Takeovers at Reddit.comDuplicateImproper Access Control - Generic · medium · Reddit
    8 votes
11. No server side check on terms of service page which leads to bypassDuplicateClient-Side Enforcement of Server-Side Security · medium · Acronis
    8 votes
12. Improper access control when an added email address is deleted from authenticationDuplicateImproper Access Control - Generic · high · Weblate
    8 votes
13. Cache purge requests are not authenticatedDuplicateImproper Access Control - Generic · Fastly VDP
    7 votes
14. Session Duplication due to Broken Access ControlDuplicateImproper Access Control - Generic · high · WakaTime
    5 votes
15. Private eth key foundDuplicateImproper Access Control - Generic · Sifchain
    4 votes
16. CSP Policy Bypass and javascript executionDuplicateImproper Access Control - Generic · Gratipay
    4 votes
17. The email API to reset password is unlimited and can be used as a email bombDuplicateImproper Access Control - Generic · low · Nextcloud
    4 votes
18. Email SpoofingDuplicatePrivilege Escalation · Skyliner
    3 votes
19. CSP Policy Bypass and javascript execution Still Not FixedDuplicateImproper Access Control - Generic · Gratipay
    1 votes