The number-one risk on the OWASP Top 10 — and the easiest to find
Broken access control is the simplest bug class on the entire OWASP list, and also the most consistently rewarded. The application authenticates the user — it knows who you are — but then forgets to check whether you are allowed to do the thing you just asked it to do.
The three flavours
Vertical escalation is when a regular user reaches admin functionality. Horizontal escalation is when one user reaches another user's data — the classic IDOR pattern. Context escalation is when an action allowed only in one state, like a finalised order, becomes reachable from another state.
Why it pays so consistently
The OWASP Top 10 has ranked broken access control as the number-one web risk for several editions in a row. That ranking is not arbitrary — it reflects the fact that almost every application ships at least one of these bugs. They are easy to find, easy to demonstrate, and they map directly to high or critical severity. This is the section to internalise first if you want to start landing reports quickly.
