Definition
Broken access control occurs when restrictions on what authenticated users can do are not properly enforced, allowing them to access unauthorized data or perform actions beyond their intended permissions. This vulnerability arises from flaws in how an application checks user privileges after authentication, leading to unintended access. It is critical because it can expose sensitive information, enable unauthorized modifications, and compromise system integrity. For instance, a user might be able to view another user's private messages by manipulating a URL parameter. This differs from authentication, which verifies a user's identity, as access control determines what that verified user is allowed to do. Broken access control is a frequently tested topic on certifications like CompTIA Security+, CySA+, and CISSP.