Authorization Weaknesses
High · Access Control
OWASP Top 10:2025 (current)
A01:2025 — Broken Access Control
Historical Top 10:2021 (not current)
A01:2021 — kept for older reports; use 2025 above.
CWE
CWE-285
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
OWASP A01:2025 · OWASP A01:2021 · CWE-285
Definition
Users perform actions beyond their role.
Root cause
Client-side or inconsistent permission checks.
Affected components
- RBAC middleware
- Admin APIs
- Feature flags
Impact
Privilege escalation.
Severity
High
Safe lab reproduction
Juice Shop admin section challenge
Detection methodology
Role-based test matrices.
Evidence examples
- Role matrix fail in lab
Remediation
Centralized, deny-by-default authorization.
Secure coding examples
Implement RBAC/ABAC server-side.
Related CYNARKS lessons & labs
Tools: burp
Primary 2025 class: A01:2025 — Broken Access Control
Practise related skills in Labs or deepen on Academy library.