Broken access control
Access control is the rule about who is allowed to do what. It breaks when the app checks permissions in the interface but not on the server: hiding an admin button, but still answering the admin request if someone sends it directly.
What it looks like
A regular user reaches an admin page by typing its URL, or triggers a privileged action by replaying a request. The app assumed that because the UI does not show the option, nobody can use it.
Why it matters
This lets ordinary users escalate to admin, edit other people's data, or run actions meant for staff. Combined with predictable IDs, it becomes a full takeover of the app's data.
How ArgosX detects it
ArgosX signs in with the roles you provide and checks whether a lower-privileged user can reach higher-privileged routes and actions, then shows what got through.
How to fix it
Enforce permissions on the server for every protected route and action.
- Check the user's role and ownership in the handler, not just in the UI.
- Deny by default: a request with no clear permission should fail.
- Do not depend on hidden links or disabled buttons as security.
Check your own app for this, free.
A free scan runs in minutes, no signup. Where it finds this, it proves it with the request and screenshot, not just a maybe. A human-verified pass is available when you want a person to confirm every finding.