Authorization Bypass and IDOR

What Is Broken and Why

Access control failures occur when applications enforce authorization only at the UI layer, rely on obscurity of object identifiers, or fail to validate that the requesting session owns the referenced resource. Horizontal bypass allows users to access peer accounts' data by swapping identifiers. Vertical bypass allows low-privileged users to invoke admin-only operations by replaying high-privilege request structures with a low-privilege session. IDOR (Insecure Direct Object Reference) exposes any predictable or discoverable resource identifier as a direct handle to unauthorized data. Special request headers (X-Original-URL, X-Rewrite-URL) can override routing in some reverse proxy configurations, bypassing ACL rules applied at the path level.

Key Signals