What is Broken Access Control?
When users can access data or perform actions they shouldn't be allowed to — like viewing other users' data or accessing admin features.
In plain English
A hotel where every room key opens every door. Your app might check that someone has a key (is logged in) but doesn't verify they should access that specific room (that specific user's data or admin features).
How it happens
The most common form: your API endpoint /api/users/123/data checks that the requester is logged in but doesn't verify they're user 123. Any authenticated user can change the ID and access anyone's data. This is called an Insecure Direct Object Reference (IDOR). Another form: admin pages that only hide the navigation link but don't check authorization on the route itself.
How to prevent it
Check authorization on every request, not just authentication. When a user requests /api/users/123/data, verify that the authenticated user is actually user 123 (or has admin privileges). In Supabase, this means proper Row-Level Security policies. In custom APIs, this means authorization checks in every endpoint handler.
Why AI-built apps are vulnerable
AI tools often implement authentication (login/signup) but skip authorization (who can access what). The UI hides admin links from regular users, but the API endpoints are unprotected. In Supabase apps, RLS policies are frequently missing or set to 'true' (allowing everyone).
Frequently asked questions
How do I test for broken access control?
Log in as User A and try to access User B's data by changing IDs in URLs and API requests. Try accessing admin endpoints without admin privileges. Check if you can modify another user's data. Our security scan tests for these issues automatically.
Check your app
Get a professional review of your app at a fixed price.
Security Scan
Black-box review of your public-facing app. No code access needed.
- OWASP Top 10 checks
- SSL/TLS analysis
- Security headers
- Expert review within 24h
Code Audit
In-depth review of your source code for security, quality, and best practices.
- Security vulnerabilities
- Code quality review
- Dependency audit
- AI pattern analysis
Complete Bundle
Both scans in one package with cross-referenced findings.
- Everything in both products
- Cross-referenced findings
- Unified action plan
100% credited toward any paid service. Start with an audit, then let us fix what we find.
Related terms
Worried about broken access control in your app?
Get a professional code audit ($19) or book a free call to discuss your concerns.