#broken-access-control

Four IDORs, One Target: Broken Access Control in a Gaming Platform ⭐

Hello, my name is Arshia, and this is my first write-up . I hope you enjoy reading it.

Protect What Matters with a Smart Access Control System in Bahrain

Deploying a reliable Access Control System in Bahrain has become a strategic priority for businesses, government agencies, financial…

Access control blind spot in the age of AI agents

This article builds on my earlier DEV article, “How is your IAM? | Google Cloud edition”, which won a DEV challenge. I originally wrote…

BAC + CSRF

It was a Self-Hosted program with limited scope, so I started exploring the main application

Physical Infrastructure Cybersecurity in UAE: How Weak CCTV and Access Control Integration Creates…

Understanding Physical Infrastructure Cybersecurity in UAE Buildings

$850 Authorization Bypass: Viewer Accessing Automations & Webhook Data via API

Hi Everyone! While testing a SaaS platform (ExampleCenter), I discovered an authorization bypass vulnerability that allowed a…

How I Hunt Broken Access Control

A methodology writeup. No named targets, no live exploits — just how I think about who’s allowed to touch what.

IAA: THE FOUNDATION OF SECURE ACCESS CONTROL

🔐 Dictionary Attack Lab Writeup

Challenge: Weak Login Credentials Platform: Hackviser Lab Difficulty: Easy Category: Web Security / Authentication

Excessive Data Exposure Leading to Unauthorized Access to Paid Features

How a Single API Response Led to Full Paid Access

Gift List — Predictable Admin Access Token Brute Force

Overview

$800 Bounty: Privilege Escalation via API — From Scheduler to Team Admin

Your AI Agent Is Just Another Intern Employee

If your Agentic AI is just another worker at your organisation, why not treat it that way? Give it its own GitHub user account, its own…

From 401 to BAC: How a Refresh Broke Workspace Authorization

The Setup

[BAC] Improper Authorization in Public Facebook Groups

While testing access control mechanisms in Facebook Groups, I started with a simple assumption: each role should have clearly defined…

🔓 Improper Access Control in Spring Boot Actuator

How a Misconfigured Endpoint Exposed Internal Application Configuration

Broken Access Control

Access control vulnerabilities

A Critical IDOR Vulnerability That Allowed Deletion & Modification of (Any) User’s Address (Mass…

بسم الله الرحمن الرحيم

[Two Chaining IDOR] Critical Broken Access Control Allowing Unauthorized Participant Deletion In…

In this write-up, I’ll walk you through a juicy Broken Access Control vulnerability I discovered during a security assessment. It allowed…

Automate IDOR Hunting Like a Pro with Burp Suite’s Autorize Extension

Manually testing for IDOR and access control vulnerabilities is painful and inefficient. Imagine you’re testing a large web app with 100+…

🔓 Broken Access Control: The Quiet Killer in Web Applications

Hidden tokens, endpoints led to large compromise