Tech teamRunning a website or small org
Broken access control
People reaching data or actions they should never be allowed.
Understand it
The top web-application risk in OWASP 2025. The app fails to check properly who may do what, so changing a number in a web address, or a quiet request, lets someone see or alter another person’s data.
How to spot it
On your own app: can an ordinary user reach admin pages, or others’ records, by guessing addresses or IDs?
Close the gap
- Check permission on the server for every action - never trust the browser.
- Deny by default; grant access deliberately, not as an afterthought.
- Hiding a button is not enough - the hidden action must still be refused.
- Test as each role, including as no one at all.
What to do about it
This sits with whoever builds and runs your website or systems - it’s beyond what a personal plan should promise to fix. If that’s not you, hand it to whoever looks after your security. We’d rather be honest about where we stop.
Your own accounts and devices are still worth protecting; your plan covers those.