The newest Authorization / Broken Access Control resources are on the Authorization / Broken Access Control page. For a reading order instead of a date order, see the Authorization / Broken Access Control learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-22 2026 | CVE-2026-32877 - Red Hat Security Advisory news 1 min read | Writeup of CVE-2026-32877 details a flaw in the Botan C++ cryptography library. During SM2 decryption, a missing validation of the authentication code (C3) length allows a remote attacker to provide a crafted ciphertext. This can trigger a heap over-read of up to 31 bytes, leading to denial of service through a crash or undefined behavior. Mitigation is not readily available for this vulnerability. |
| 2026-04-22 2026 | What is Google Zanzibar? beginner 8 min read | Library detailing Google Zanzibar, a consistent, global authorization system that implements relationship-based access control (ReBAC). It explains namespaces, relation tuples with the format `<object>#<relation>@<user>`, schema configuration, and the 'zookie' for user-specified consistency. The system leverages Google's Spanner database and employs layered caches and request hedging for scalability and performance, offering core API methods for read, write, watch, check, and expand operations. |
| 2026-04-19 2026 | Broken Access Control: The Quiet Killer in Web Applications beginner | Broken Access Control: The Quiet Killer in Web Applications → infosecwriteups.com |
| 2026-04-19 2026 | Broken Access Control: The Silent Web Vulnerability beginner | Broken Access Control: The Silent Web Vulnerability |
| 2026-04-19 2026 | Broken Access Control: The 40% Surge in 2025 news 10 min read | Library for identifying and preventing broken access control vulnerabilities, a pervasive and critical application security risk that surged in 2025. This library addresses common weaknesses like vertical and horizontal privilege escalation, Insecure Direct Object References (IDOR), forced browsing, and missing function-level access control, which attackers exploit to gain unauthorized data access. It is designed to mitigate the impact of these flaws, which are exacerbated by rapid development cycles, complex architectures, and the introduction of vulnerabilities from AI-generated code. |
| 2026-04-19 2026 | OWASP Top 10 2025 — A01 Broken Access Control beginner 3 min read | Reference detailing OWASP Top 10 2025 A01: Broken Access Control, the most prevalent vulnerability. It highlights common weaknesses like insecure direct object references, privilege escalation, JWT manipulation, CORS misconfigurations, and force browsing. Prevention strategies emphasize server-side enforcement, deny-by-default principles, robust access control mechanisms, and proper session management with short-lived JWTs or refresh tokens. The document also mentions related CWEs such as CWE-200, CWE-201, CWE-918 (SSRF), and CWE-352 (CSRF), and provides example attack scenarios. → owasp.org |
| 2026-04-16 2026 | Enhancing OAuth 2.0 Security with PKCE: Deep Dive advanced 4 min read | Walkthrough of OAuth 2.0 integration with PKCE, detailing how Omnissa Intelligence uses the Proof Key for Code Exchange extension to prevent authorization code interception attacks when connecting with External Partner services. The process involves `code_verifier`, `code_challenge`, and `code_challenge_method=S256` to securely exchange authorization codes for access tokens, safeguarding against session hijacking and man-in-the-middle attacks. |
| 2026-04-16 2026 | Attacks via OAuth Authorization Code Injection intermediate AuthN | Attacks via OAuth Authorization Code Injection |
| 2026-04-16 2026 | Security Benchmarking Authorization Policy Engines: Rego, Cedar, OpenFGA advanced 9 min read | Framework for dynamically evaluating authorization policy engines, including Rego, Cedar, OpenFGA, and Teleport ACD. This system automates security benchmarking and robustness testing by executing predefined test cases in isolated Docker containers for each engine, comparing actual results against expected outcomes to identify potential threats and vulnerabilities. |
| 2026-04-16 2026 | Privilege Escalation by JWT Token Manipulation intermediate | Privilege Escalation by JWT Token Manipulation |
| 2026-04-16 2026 | JWTs Under the Microscope: Exploiting Auth Weaknesses - Traceable intermediate 7 min read | Library for identifying and exploiting JWT authentication weaknesses. It details vulnerabilities like Improper JWT Signature Validation, JWT Algorithm Confusion, JWT Weak Secret, and attacks leveraging KID fields (SQL Injection, SSRF, Path Traversal), JKU/X5U misuse, X5T collisions, and payload manipulation leading to Broken Object Level Authorization (BOLA) and Broken Functional Level Authorization (BFLA), as well as JWT Expired Token issues. |
| 2026-04-16 2026 | Privilege Escalation via IDOR and ACL Bypass in SaaS intermediate | Privilege Escalation via IDOR and ACL Bypass in SaaS |
| 2026-04-16 2026 | Organization Takeover via Privilege Escalation (IDOR) intermediate | Organization Takeover via Privilege Escalation (IDOR) |
| 2026-04-16 2026 | Horizontal Privilege Escalation via IDOR intermediate | Horizontal Privilege Escalation via IDOR |
| 2026-04-16 2026 | Fine-Grained Authorization: Technical Guide for Microservices intermediate 6 min read | Guide to fine-grained authorization for microservices, moving beyond traditional RBAC to Relationship-Based Access Control (ReBAC). It details the limitations of RBAC in dynamic environments and advocates for centralized policy engines like Open Policy Agent (OPA) and Zanzibar-inspired systems (e.g., OpenFGA). The guide provides a practical roadmap for implementation, focusing on auditing relationships, centralizing the source of truth, and iteratively decoupling authorization logic from individual services. |
| 2026-04-16 2026 | RBAC vs ABAC vs ReBAC: How to Choose Access Control Models beginner 12 min read | Library comparing Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Relationship-Based Access Control (ReBAC). It details how RBAC, while simple, suffers from "Role Explosion" due to complexity in systems like AWS IAM and Kubernetes. ABAC is presented as a solution, using attributes and dynamic evaluation instead of static roles, exemplified by OPA and AWS IAM's Condition blocks. ReBAC principles are also touched upon, particularly in the context of Azure's resource hierarchy inheritance. |
| 2026-04-15 2026 | Privilege Elevation Dominates Massive Microsoft Patch Update news 4 min read | Library of patches addressing Microsoft's April 2026 update, which included 165 CVEs, with a significant portion being elevation-of-privilege bugs. Key vulnerabilities detailed include CVE-2026-32201 (a SharePoint Server spoofing zero-day actively exploited), CVE-2026-33825 (a Defender privilege escalation zero-day), CVE-2026-33824 (a critical RCE in Windows IKE Service Extensions), and CVE-2026-33827 (a rare unauthenticated RCE in Windows secure tunneling). The update also featured numerous fixes for Microsoft Edge and Chromium. → darkreading.com |
| 2026-04-11 2026 | Policy as Code: Fine-Grained Authorization intermediate 10 min read | Library detailing Policy as Code for fine-grained authorization, featuring discussions on Rego for Open Policy Agent (OPA), AWS Cedar, and OpenFGA. The resource highlights the practice of defining policies with code for dynamic and adaptable management, distinguishing between validation and authorization, and emphasizing how policy languages abstract API complexities for easier rule definition and enforcement. Experts Jimmy Ray and Omer Zuarets share insights on applying policy as code in cloud-native security and simplifying policy implementation through tooling. |
| 2026-04-11 2026 | Policy Engine Showdown: OPA vs OpenFGA vs Cedar intermediate 17 min read | Reference to a panel discussion comparing application policy engines OPA, OpenFGA, and Cedar. The session, "Policy Engines Showdown," featured engineers discussing the strengths, trade-offs, and practical considerations of each engine, including OpenFGA's ReBAC model, Cedar's policy-driven approach, and OPA's multipurpose flexibility. The goal was to help developers select the best decision engine for their specific use cases, highlighting that suitability depends on implementation needs rather than a single "winner." The discussion also touched upon tools like OPAL for policy synchronization. |
| 2026-04-11 2026 | ReBAC Authorization Academy - Oso beginner 19 min read | Library exploring Relationship-Based Access Control (ReBAC) for application security, using the GitClub example to illustrate how permissions can be organized based on relationships between resources like users, repositories, and issues. It contrasts ReBAC with Role-Based Access Control (RBAC) and Attribute-Based Access Control (ABAC), highlighting how ReBAC can elegantly handle data ownership scenarios where users need specific permissions on resources they created or are directly associated with. The library guides developers to leverage existing data structures to define these relationships, providing a natural and intuitive authorization model that complements traditional RBAC. |
| 2026-04-11 2026 | RBAC vs ABAC vs PBAC - Oso beginner 12 min read | Library for implementing consistent, maintainable authorization across distributed systems. It details Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and Policy-Based Access Control (PBAC), showcasing how Oso's Polar language enables declarative definition and enforcement of RBAC and ABAC through PBAC. This approach centralizes authorization logic into a single policy engine, ensuring uniform decisions based on user roles, attributes, and contextual data, enhancing auditability and simplifying evolution of access control policies across microservices. |
| 2026-04-11 2026 | RBAC vs ABAC vs ReBAC - Oso beginner 6 min read | Reference detailing RBAC, ABAC, and ReBAC access control paradigms, comparing their strengths and limitations for applications. It highlights RBAC's role-based assignments, ABAC's attribute-driven policies, and ReBAC's relationship-based permissions. The document explains how these models can be combined for fine-grained authorization and suggests Oso as a tool to simplify implementation. |
| 2026-04-11 2026 | Fine Grained Authorization using SpiceDB for RAG intermediate 5 min read | Library implementing fine-grained authorization for RAG using SpiceDB. This resource details how to integrate SpiceDB with Pinecone, Langchain, and OpenAI to enforce relationship-based access control (ReBAC) on document retrieval for AI applications. It covers schema definition, relationship writes, and querying authorized resources to pre-filter vector database searches, enhancing both security and efficiency in enterprise AI. |
| 2026-04-11 2026 | Relationship-Based Permissions in SpiceDB intermediate 6 min read | Library for managing application permissions using Relationship-Based Access Control (ReBAC). SpiceDB, inspired by Google's Zanzibar, stores relationships between subjects and resources to efficiently answer permission queries. It supports robust write patterns, including two-phase commits with relational databases and streaming commits via systems like Kafka, ensuring data consistency. Alternatively, relationships can be stored solely within SpiceDB, simplifying application logic and enabling schema-driven permission computation. Asynchronous updates are also an option for applications tolerating less strict consistency. |
| 2026-04-11 2026 | Introduction to Google Zanzibar beginner 21 min read | Reference on Google Zanzibar, an authorization system developed to manage permissions across Google's vast product suite, detailing its relationship-based access control (ReBAC) model. It explains how Zanzibar overcomes the limitations of application-specific authorization, addresses the "new enemy problem" through external consistency guarantees, and scales to handle billions of users and trillions of objects with low latency. The resource also highlights how open-source tools like SpiceDB can be used to implement similar systems, drawing parallels to Google's internal infrastructure and the significance of the 2019 Zanzibar research paper. |
| 2026-04-11 2026 | OpenFGA: Open-Source Engine for Access Control beginner 2 min read | Library for relationship-based access control, OpenFGA is an open-source, high-performance engine inspired by Google’s Zanzibar system. It allows developers to define and enforce fine-grained permissions with support for multiple storage backends, including PostgreSQL and MySQL, and offers APIs and SDKs in Java, Node.js, Go, Python, and .NET. OpenFGA integrates relationship-based, role-based, and attribute-based access control models, and includes a CLI, playground, and Terraform provider for easier management and testing. Notable adopters include Auth0 and Grafana Labs. → helpnetsecurity.com |
| 2026-04-11 2026 | Announcing OpenFGA news 7 min read | Library for fine-grained authorization, OpenFGA, is an open-source engine inspired by Google's Zanzibar. It allows developers to model complex access control rules, integrate them consistently across applications, and manage permissions efficiently at scale. OpenFGA features an expressive modeling language, HTTP APIs for checking and writing permissions, and supports various integrations with identity providers and proxies, addressing security, compliance, and privacy needs for modern collaborative and social applications, effectively tackling OWASP's top risk: broken access control. |
| 2026-04-11 2026 | Authorization Concepts - OpenFGA beginner 2 min read | Reference detailing OpenFGA's approach to authorization, explaining Fine-Grained Authorization (FGA) and contrasting Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), Policy-Based Access Control (PBAC), and Relationship-Based Access Control (ReBAC). It highlights ReBAC as a superset of RBAC and a solution for ABAC scenarios, noting OpenFGA extends ReBAC with Conditions and Contextual Tuples, drawing parallels to Google's Zanzibar system. |
| 2026-04-11 2026 | Cedar Policy Language Complete Guide intermediate 2 min read | Library for fine-grained authorization, Cedar is an open-source policy language built in Rust that decouples access control from application logic. It supports RBAC, ABAC, ReBAC, and *BAC models, and is designed for simplicity, expressiveness, and performance, allowing for modular and reusable authorization policies. Cedar's evaluation logic prioritizes `forbid` statements, ensuring requests are denied if any matching `forbid` policy exists. |
| 2026-04-11 2026 | Amazon Verified Permissions - Cedar intermediate 4 min read | Library for externalizing authorization and centralizing policy management, Amazon Verified Permissions leverages the Cedar policy language to enable developers to build secure applications and align with Zero Trust principles. It accelerates development by decoupling authorization from business logic, streamlining security with intuitive, policy-based access controls that support common frameworks. This service helps protect resources, manage user access according to the principle of least privilege, and facilitates granular authorization decisions. Users include TELUS for smart home device permissions, Grosvenor Engineering Group for building asset access, and STEDI for protecting healthcare transaction endpoints. → aws.amazon.com |
| 2026-04-11 2026 | Cedar Policy Language Reference intermediate 5 min read | Reference for Version 4.5 of the Cedar policy language, used for writing authorization policies and making decisions. Cedar decouples business logic from authorization, allowing applications to query an engine for "allow" or "deny" decisions based on policies, entities, context, and a schema. This separation simplifies updates and testing, as security teams can modify policies without touching application code. Cedar supports attributes, logical operators, and dynamic evaluation for fine-grained control, role-based access control (RBAC), and attribute-based access control (ABAC), with features like fast, scalable, and bounded-latency evaluation. |
| 2026-04-11 2026 | Basic ABAC with OPA and Rego - AWS intermediate 3 min read | Library demonstrating basic Attribute-Based Access Control (ABAC) with OPA and Rego. It provides example Rego code snippets for a fictional Payroll microservice, illustrating how to enforce policies such as "Employees can read their own salary" and "Employees can read the salary of anyone who reports to them," utilizing external data for manager-report relationships. |
| 2026-04-11 2026 | OPA Rego Language Tutorial beginner 11 min read | Tutorial on Rego, the declarative policy language for Open Policy Agent (OPA), detailing its fundamental constructs and mechanisms. Learn how Rego's logic-based syntax enables codifying rules for authorization, configuration validation, and data filtering, particularly within Kubernetes and Envoy. The tutorial covers writing Rego policies, including decisions, variable assignments, and using the "some" keyword for iterating over data structures, along with best practices for effective policy authoring. |
| 2026-04-11 2026 | What is Open Policy Agent (OPA)? beginner 6 min read | Library for managing cloud-native policies, Open Policy Agent (OPA) offers a unified, context-aware approach by decoupling policy enforcement from application code. It uses the Rego policy language for expressive, declarative rules, enabling security and compliance through policy-as-code, consistency across Kubernetes, microservices, and CI/CD pipelines, and efficient updates via a centralized policy library. → wiz.io |
| 2026-04-11 2026 | OPA: Best Practices for Secure Deployment - CNCF intermediate 11 min read | Library for secure Open Policy Agent (OPA) deployment, focusing on preventing vulnerabilities like remote calls and Windows UNC path exploits by emphasizing separation of policy code from application code, decoupling schema and data through external sources, and structured data management. It highlights best practices derived from large-scale OPA usage, including techniques for restricting sensitive built-ins and leveraging tools like OPAL for synchronized policy and data updates. |
| 2026-04-11 2026 | Kubernetes RBAC Best Practices beginner 10 min read | Reference detailing Kubernetes RBAC best practices, emphasizing the importance of the principle of least privilege (PoLP) and regular permission reviews. It highlights the risks of misconfigured RBAC, citing the "RBAC Buster" attack, and recommends tools like Open Policy Agent (OPA) for automating policies and Wiz for auditing. The entry also covers using namespaces for scope limitation, auditing RBAC events, securing sensitive operations, and integrating with external identity providers. → wiz.io |
| 2026-04-11 2026 | Kubernetes RBAC Good Practices beginner 6 min read | Reference on Kubernetes RBAC best practices, detailing how to minimize privilege escalation risks by assigning least privilege to users and service accounts. It highlights dangerous permissions such as `cluster-admin`, `system:masters`, `nodes/proxy`, `escalate`, `impersonate`, and direct access to the CSR API and service account tokens. The document also advises against granting broad permissions to create workloads, PersistentVolumes, or modify namespaces, emphasizing the importance of reviewing default access and periodic audits. |
| 2026-04-11 2026 | NIST SP 800-162: Guide to ABAC beginner | NIST SP 800-162: Guide to ABAC |
| 2026-04-11 2026 | Authorization Testing Automation Cheat Sheet - OWASP intermediate 10 min read | Cheat sheet offering a methodology for automating authorization tests by formalizing an authorization matrix in XML. This approach enables the creation of integration tests that validate access controls for REST services across different logical roles like ANONYMOUS, BASIC, and ADMIN. The process involves defining roles, services with their associated permissions, and test payloads to ensure new feature additions or modifications do not conflict with existing authorization definitions. → cheatsheetseries.owasp.org |
| 2026-04-11 2026 | Access Control Cheat Sheet - OWASP intermediate | Access Control Cheat Sheet - OWASP → cheatsheetseries.owasp.org |
| 2026-04-11 2026 | Authorization Cheat Sheet - OWASP intermediate 18 min read | Cheatsheet providing guidance for robust authorization logic, addressing concerns like Broken Access Control, a top OWASP 2021 vulnerability. It details implementing "Least Privileges" by granting only necessary permissions and adopting a "Deny by Default" approach for all requests, emphasizing the need for validation on every interaction to prevent unauthorized access to resources, which can impact confidentiality, integrity, and availability. → cheatsheetseries.owasp.org |
| 2026-04-10 2026 | BLA9:2025 Broken Access Control - OWASP beginner 2 min read | Reference detailing BLA9:2025 Broken Access Control, a critical OWASP Top 10 vulnerability. It explains how missing role checks, flawed logic trusting client-supplied parameters, overly broad permissions, and identifier tampering (BOLA) enable attackers to perform unauthorized operations. Examples include Gitlab branch deletion vulnerabilities and privilege escalation in hay-kot mealie v2.2.0, mapping to CWEs like CWE-863 and CWE-862, and referencing CVEs such as CVE-2021-39931 and CVE-2023-3290. → owasp.org |
| 2026-04-10 2026 | Broken Access Control: 40% Surge in 2025 news | Broken Access Control: 40% Surge in 2025 |
| 2026-04-10 2026 | Defending Against Broken Access Control beginner 10 min read | Library for defending against Broken Access Control (BAC), the #1 threat (A01:2021) in the OWASP Top 10. This vulnerability occurs when applications fail to enforce authorization, allowing unauthorized users to access data or functions. Learn about common attack techniques like Horizontal and Vertical Privilege Escalation, Parameter Tampering, IDOR, Data Exposure, API Abuse, and BOLA. The resource highlights real-world examples such as the Optus data breach and the Kia vehicle control vulnerability, emphasizing the critical need for robust server-side authorization. |
| 2026-04-10 2026 | Why Broken Access Control Dominates OWASP Top 10 in 2026 beginner 7 min read | Library for building secure applications, focusing on mitigating Broken Access Control (BAC) and Broken Object Level Authorization (BOLA). It highlights how traditional SAST and DAST tools struggle with these logic flaws, contrasting them with technical vulnerabilities like SQL Injection. The library advocates for centralized authorization logic using the Policy Decision Point (PDP) and Policy Enforcement Point (PEP) pattern, and promotes Policy as Code (PaC) with tools like Auth0 FGA, OpenFGA, and OPA to manage authorization policies externally from application code. |
| 2026-04-10 2026 | Broken Access Control: How to Detect and Prevent beginner 7 min read | Library of techniques for detecting and preventing broken access control vulnerabilities, the most impactful risk category in the OWASP Top 10. This resource details exploitation methods like vertical and horizontal privilege escalation, insecure direct object references (IDOR), and bypasses via predictable identifiers, parameter tampering, and path variations, offering best practices to mitigate these widespread security weaknesses. → invicti.com |
| 2026-04-10 2026 | OWASP A01: Broken Access Control Risks and Prevention beginner 16 min read | Library detailing OWASP A01: Broken Access Control risks and prevention. This resource clarifies the distinction between authentication and authorization, highlights the importance of the principle of least privilege (PoLP) and Role-Based Access Control (RBAC), and provides a Python Flask code snippet demonstrating secure RBAC implementation. It further explains how vulnerabilities manifest through techniques like URL manipulation and parameter tampering, and identifies common failure scenarios such as Insecure Direct Object References (IDOR) and missing function-level access control. |
| 2026-04-10 2026 | OWASP-TOP-10 A01:2025 Broken Access Control beginner 2 min read | Library detailing Broken Access Control, a critical OWASP Top 10 risk where applications fail to enforce user restrictions. This resource highlights how attackers can exploit missing or client-side enforced authorization checks, using tools like Burp Suite to directly access backend administrative endpoints. It demonstrates the vulnerability through a case study of an application trusting client-side role validation, leading to unauthorized data access, privilege escalation, and account compromise, and emphasizes implementing server-side authorization and the principle of least privilege for mitigation. |
| 2026-04-10 2026 | CVE-2025-67274: Broken Access Control in aangine news IDOR | CVE-2025-67274: Broken Access Control in aangine |
| 2026-04-10 2026 | CVE-2026-33312: BOLA in Vikunja news 4 min read IDOR | Writeup detailing CVE-2026-33312, a Broken Object Level Authorization (BOLA) vulnerability in Vikunja versions 0.20.2 through 2.1.x. This Incorrect Authorization flaw allows read-only users to permanently delete project background images by exploiting an authorization check designed only for read permissions within the `RemoveProjectBackground` function. The vulnerability, categorized under CWE-863, is fixed in version 2.2.0. |