AuthorizationHighBroken access controlPrivilege escalation

Authorization Issues

The app authenticates users but fails to enforce what they are allowed to do.

Overview

Missing function- and object-level checks let users reach admin functions, other tenants’ data, or elevated roles by editing requests (BFLA/BOLA, forced browsing, parameter tampering).

How it works

Missing function- and object-level checks let users reach admin functions, other tenants’ data, or elevated roles by editing requests (BFLA/BOLA, forced browsing, parameter tampering).

Example

http

POST /api/users/42/role  {"role":"admin"}   # by a non-admin user -> 200 OK

Impact

Privilege escalation, cross-tenant access, and administrative takeover.

Detection

Replay privileged and cross-account requests with low-privilege sessions; flag any that succeed.

Prevention

Centralize authorization and deny by default.
Check both function-level and object-level permissions on every request.
Drive access from server-side roles, never client claims.

Real-world HackerOne reports

Sampled from 45 disclosed reports analyzed for the Authorization Issues research playbook.

#1021776 #1084939 #1091380 #1102365 #1102652 #1102660 #1175980 #1212374