Security vulnerabilities caused by missing access controls

This article explains an established weakness category. It does not describe a new finding by CCS.

What is a security vulnerability?

A weakness becomes a security issue when it can expose or alter data, or disrupt a service. It may come from a programming error, the configuration or the design of the system. [1]

Signing in and having permission

Signing in establishes a user’s identity. It does not determine which data they are allowed to access. OWASP calls failures to check those permissions “Broken Access Control”. [2]

Example: a document portal

Mira and Noah have separate accounts in a document portal. Each should see only their own documents. For every request, the server needs to check who owns the document. Being signed in or supplying a document number is not enough. MITRE describes this weakness as CWE-639. [3]

What developers should check

Permissions must be checked on the trusted server side for every request. Access should be denied unless it is explicitly granted. Users should receive only the permissions they need. Hidden buttons and hard-to-guess identifiers do not replace these checks. [4]

The important question

Ask not just “Is this person signed in?” but also “May this person read or change this particular record?” These are separate questions.

Report an observation

Investigate only systems you own or have explicit permission to test. If you want to report an observation to CCS, start with a short description without anyone else’s data. Contact and reporting →

Sources and further reading

Sources checked on 19 October 2026.

← Back to knowledge