What is broken access control?
Broken access control means your app lets people do or see things they shouldn't, even though they're logged in correctly. A normal user opens another user's data, or reaches an admin page, because the app checked who they were but not what they're allowed to do.
Also called: Missing authorization, BOLA
ON THIS PAGE
What it means
Logging in answers the question "who are you?". Access control answers "what are you allowed to do?". Many apps get the first right and skip the second.
It shows up as a user changing a number in a web address to see someone else's order, a button hidden in the page that still works if called directly, or an admin route that only checks that a user is logged in.
Why it matters for vibe-coded apps
It's the most common serious web security problem, and AI tools make it easy to create: they build screens that look right, but the server behind them often trusts whatever the browser asks for.
- One customer can read, change or delete another customer's data.
- Hiding a button is not protection: anyone can call the route behind it directly.
- Admin-only features can be reached by ordinary users.
Example
An endpoint that returns an invoice.
app.get("/api/invoices/:id", requireLogin, async (req, res) => {
const invoice = await db.invoices.findById(req.params.id);
res.json(invoice);
});app.get("/api/invoices/:id", requireLogin, async (req, res) => {
const invoice = await db.invoices.findOne({
id: req.params.id,
userId: req.user.id, // only their own
});
if (!invoice) return res.status(404).end();
res.json(invoice);
});Enforce the rule on the server, or in the database with row level security. Never rely on the front end to hide things.
How to check if your app has this problem
- 1Log in as one test user, copy the web address of one of their records, then open it while logged in as a second user.
- 2Look at each route that reads or changes data and check it compares the record's owner to the logged-in user.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Add an owner check to every route that reads or changes a record.
- 2Put the admin check on the server, not just on the page.
- 3Turn on row level security so the database enforces the same rule.
- 4Test with two accounts and run a check again.
Review every API route and database query in my app for missing access control. Make each one confirm that the record belongs to the logged-in user (or that the user has the admin role) on the server, and return a 404 or 403 otherwise.
Check if your app has this problem
Paste your website and we'll check for broken access control issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Authentication vs authorizationChecking who someone is, versus checking what they're allowed to do.
- Row level securityA database setting that decides which rows each user can see or change.
- Insecure direct object reference (IDOR)Changing an ID in a web address shows someone else's data.
- Unprotected API routeA backend address that does something useful but never checks who is calling it.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.