A01:2025 — Broken Access Control
Verified by Precogs Threat Research
What is Broken Access Control (OWASP A01:2025)?
Failures in access control enforcement that let users act outside their intended permissions. This includes bypassing access checks by modifying URLs, APIs, or internal application state; viewing or editing another user's account; privilege escalation; CORS misconfiguration; and SSRF (now consolidated into A01 from the previous A10).
Impact
The #1 risk in OWASP 2025, maintaining its top position from 2021. 94% of tested applications had some form of broken access control. Now also encompasses SSRF risks. Leads to unauthorized data disclosure, modification, or destruction.