security access_error ai_generated true

Unauthorized access to restricted resource

ID: security/broken-access-control

Also available as: JSON · Markdown
82%Fix Rate
86%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

User can access resources belonging to other users.

generic

Workarounds

  1. 92% success Implement server-side authorization checks on every request
  2. 88% success Use indirect references (UUIDs) instead of sequential IDs

Dead Ends

Common approaches that don't work:

  1. Add client-side access checks only 92% fail

    Easily bypassed with dev tools

  2. Hide URLs instead of checking authorization 88% fail

    Security through obscurity