Authorization

Comprehensive IDOR Guide 🆕 Updated September 12, 2026 — added the Frappe/ERPNext Document Follow chain (CVE-2026-66000/66058/66059) and why subscribe-style features create standing grants nobody re-checks. A practitioner’s reference for Insecure Direct Object Reference (IDOR) and Broken Object Level Authorization (BOLA) — attack surface, enumeration patterns, bypass techniques, real-world writeups, detection workflow, and prevention. Pairs with: Authorization & Access Control for the bigger picture IDOR sits inside · API Security since BOLA tops the OWASP API Top 10 · Bug Bounty Methodology for where IDOR testing fits a real hunt. ...

Comprehensive Authorization & Access Control Guide 🆕 Updated September 12, 2026 — added the SolarWinds Web Help Desk SAML bypass (CVE-2026-28323): when parameter presence selects the auth path, the attacker picks it. A practitioner’s reference for Broken Access Control (OWASP A01) — the models, bug classes, bypass techniques, real-world chains, and detection/prevention patterns that matter in modern web and API testing. Includes privilege escalation CVEs disclosed through 2026. 🔥 Latest Update: May 2, 2026 - Enhanced with 2026 privilege escalation CVEs including CVE-2025-26244 (DeimosC2), CVE-2026-25253+ (OpenClaw chain), CVE-2025-53767 (Azure OpenAI) from automated security intelligence. ...

The quick-reference authorization checklist Broken authorization is the number one bug class in APIs, and it has three faces. This is the scannable checklist I run through when I’m testing an API for it — definitions, setup, and copy-paste test steps for each. For the full exploitation depth (every bypass primitive, parser quirks, real CVEs) see the API Security guide; for the rest of an API test (recon, auth, rate limits, GraphQL, JWT) use its full API security testing checklist. This page is the authorization checklist that sits next to it. ...

If you want the short answer to “how should I limit an AI coding agent’s permissions?”, it’s this: give the agent its own identity instead of yours, hand it short-lived credentials scoped to the one task in front of it, make read-only the default, keep production credentials somewhere it physically can’t reach, and require a human to approve anything destructive. That’s least privilege, the same rule we’ve applied to service accounts for twenty years. We just forgot to apply it to the newest and most enthusiastic service account on the team. ...

I’ve been hunting access control bugs for over a decade, and let me tell you - they’re everywhere. When OWASP moved broken access control to #1 in 2025 and merged SSRF into this category, I wasn’t surprised. I was relieved that the security community finally caught up to what I’ve been seeing in the wild. 94% of applications tested have broken access control issues. That’s not a typo - it’s a security apocalypse hiding in plain sight. ...