A01:2025 — Broken Access Control
What is Broken Access Control (OWASP A01:2025)?
Failures in access control enforcement that let users act outside their intended permissions. This includes bypassing access checks by modifying URLs, APIs, or internal application state; viewing or editing another user's account; privilege escalation; CORS misconfiguration; and SSRF (now consolidated into A01 from the previous A10).
Impact
The #1 risk in OWASP 2025, maintaining its top position from 2021. 94% of tested applications had some form of broken access control. Now also encompasses SSRF risks. Leads to unauthorized data disclosure, modification, or destruction.
How Precogs AI Addresses A01
Precogs AI detects broken access control patterns in both source code and compiled applications, identifying missing authorization checks, IDOR vulnerabilities, SSRF vectors, and privilege escalation paths.