access-control

1 post · all tags

  • The Authorization Bugs No Scanner Will Ever Find for You

    Every scanner on the market will find your reflected XSS. None of them will tell you that GET /api/invoices/8412 returns someone else’s invoice. The tool sees a 200 and a well-formed JSON body and moves on, because it has no idea that the record belongs to a different tenant.

    Broken access control stays at the top of the OWASP list for exactly this reason: it is the one bug class where the vulnerability is semantic, not syntactic.