A01 — Broken Access Control
Broken Access Control occurs when an application fails to properly enforce what users are allowed to access or perform.
For example, if a normal user can access an administrator-only page or view another user's data simply by changing an ID in the URL, the application may have an access control vulnerability.
Common examples include:
Accessing another user's data
Privilege escalation
Accessing admin functions as a normal user
Bypassing authorization checks
Key point: Authentication tells us who you are, while authorization determines what you can do.
A02 — Security Misconfiguration
Security Misconfiguration occurs when an application, server, cloud environment, or other component is configured insecurely.
Common examples include:
Default credentials
Debug mode enabled in production
Unnecessary services or ports exposed
Sensitive files publicly accessible
Missing security headers
Excessive permissions
Even a well-developed application can become vulnerable because of insecure configuration.
Key point: A secure application also needs a securely configured environment.
A01 vs A02
A simple way to remember the difference:
A01 → Permission problem
Who is allowed to do what?
A02 → Configuration problem
Is the system configured securely?
Understanding these two categories is a good starting point for anyone learning web application security and penetration testing.
Top comments (0)