Owasp Top 10

# 00 Vulnerability Index

This document provides the index for the OWASP Web Application Security Top 10 vulnerabilities.
Each entry includes its identifier, title, and primary category.

## Vulnerability catalog

| ID       | Title                                  | Category                 |
|----------|----------------------------------------|--------------------------|
| A01:2025 | Broken Access Control                  | Access Control           |
| A02:2025 | Security Misconfiguration              | Configuration Management |
| A03:2025 | Software Supply Chain Failures         | Supply Chain             |
| A04:2025 | Cryptographic Failures                 | Cryptography             |
| A05:2025 | Injection                              | Input Validation         |
| A06:2025 | Insecure Design                        | Architecture and Design  |
| A07:2025 | Authentication Failures                | Authentication           |
| A08:2025 | Software or Data Integrity Failures    | Data Integrity           |
| A09:2025 | Security Logging and Alerting Failures | Logging and Monitoring   |
| A10:2025 | Mishandling of Exceptional Conditions  | Error Handling           |

## Cross-reference matrix

Each vulnerability document follows a consistent structure:

1. Description — what the vulnerability is and how it manifests in web applications.
2. Risk — concrete consequences of exploitation and business impact.
3. Vulnerability checklist — indicators that the application is exposed.
4. Prevention controls — defensive measures and rectification steps.
5. Example attack scenarios — realistic exploitation narratives.
6. Detection guidance — signals and methods to identify exposure.
7. Remediation — immediate and long-term actions to contain and resolve.

## Category groupings

### Access Control

* A01:2025 Broken Access Control

### Configuration Management

* A02:2025 Security Misconfiguration

### Supply Chain

* A03:2025 Software Supply Chain Failures

### Cryptography

* A04:2025 Cryptographic Failures

### Input Validation

* A05:2025 Injection

### Architecture and Design

* A06:2025 Insecure Design

### Authentication

* A07:2025 Authentication Failures

### Data Integrity

* A08:2025 Software or Data Integrity Failures

### Logging and Monitoring

* A09:2025 Security Logging and Alerting Failures

### Error Handling

* A10:2025 Mishandling of Exceptional Conditions

---

Content derived from works by the OWASP Foundation, licensed under CC BY-SA 4.0
(<https://creativecommons.org/licenses/by-sa/4.0/>).
Modifications: Restructured into agent-consumable reference format with added
detection and remediation guidance.

*🤖 Crafted with precision by ✨Copilot following brilliant human instruction, then carefully refined by our team of discerning human reviewers.*


---
title: 'A01: Broken Access Control'
description: OWASP Web Top 10 reference for broken access control vulnerabilities including privilege escalation and unauthorized resource access
---

# 01 Broken Access Control

Identifier: A01:2025
Category: Access Control

## Description

Broken access control occurs when an application fails to enforce policies that prevent users from
acting outside their intended permissions.
This vulnerability allows unauthorized information disclosure, modification or destruction of data,
or performing business functions beyond the user's authorized limits.
Common manifestations include violation of the principle of least privilege, bypassing access
control checks through URL parameter tampering or API request modification, insecure direct object
references, missing access controls on API endpoints, elevation of privilege, metadata
manipulation of tokens and cookies, and CORS misconfiguration.
Access control weaknesses are pervasive across web applications, with 100% of tes