Skip to content

Cybersecurity Atlasby Jer Catallo

Cybersecurity Atlas

One reference surface for application, cloud and product security.

API documentation

Find & Respond

AppSec Playbook
Vulnerabilities Atlas

Build & Harden

Hardening Atlas
Security Tooling

Learn the Fundamentals

Security Concepts

Resources

OWASP Top 10
MITRE ATT&CK
NIST Cybersecurity Framework

© 2026 Jer Catallo. Reference material only, always confirm against the official source.

About
API Documentation

Broken Access Control incident response playbook · Cybersecurity Atlas

Home
Playbook
Broken Access Control

Broken Access Control

CriticalIdentity & AccessA01:2021 – Broken Access Control

Users can act outside of their intended permissions, accessing other users' data, modifying records, or performing privileged actions.

Immediate Response

1Revoke sessions for accounts involved in unauthorized access.
2Immediately restrict the exposed endpoints via server-side controls or WAF rules.
3Audit affected records for data integrity and unauthorized modifications.
4Determine the full scope of the breach: what data was accessed or changed.

Short-term Remediation

1Enforce access control checks server-side for every resource request - never rely on client-side enforcement.
2Implement RBAC or ABAC models with clear role definitions.
3Deny all access by default and explicitly grant permissions.
4Log all access control failures and alert on anomalies.

Long-term Prevention

1Conduct authorization unit tests for every endpoint (positive and negative cases).
2Use automated tools to test for IDOR vulnerabilities during CI/CD.
3Perform regular manual penetration tests focused on privilege escalation.
4Apply the principle of least privilege across all user roles and service accounts.

Attack vectors

Insecure Direct Object References: changing an ID in a URL to access another user's resource
Forced browsing to administrative or privileged pages
Elevation of privilege by modifying JWT claims or cookies
Missing function-level access control on API endpoints

Indicators of compromise

Access log entries showing cross-user resource requests
Requests to admin endpoints from non-privileged accounts
Repeated 403 responses followed by 200s after parameter manipulation
Anomalous data access volume for a specific user

Tooling

Burp Suite (Autorize extension)OWASP ASVSSemgrepNuclei

References

owasp.org/Top10/A01_2021-Broken_Access_Control/
cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html