# Access Control

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-cover data-type="files"></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td></td><td>Unprotected admin functionality</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/unprotected-admin-functionality">unprotected-admin-functionality</a></td></tr><tr><td></td><td>Unprotected admin functionality with unpredictable URL</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/unprotected-admin-functionality-with-unpredictable-url">unprotected-admin-functionality-with-unpredictable-url</a></td></tr><tr><td></td><td>User role controlled by request parameter</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/user-role-controlled-by-request-parameter">user-role-controlled-by-request-parameter</a></td></tr><tr><td></td><td>User role can be modified in user profile</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/user-role-can-be-modified-in-user-profile">user-role-can-be-modified-in-user-profile</a></td></tr><tr><td></td><td>User ID controlled by request parameter</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/user-id-controlled-by-request-parameter">user-id-controlled-by-request-parameter</a></td></tr><tr><td></td><td>User ID controlled by request parameter, with unpredictable user IDs</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/user-id-controlled-by-request-parameter-with-unpredictable-user-ids">user-id-controlled-by-request-parameter-with-unpredictable-user-ids</a></td></tr><tr><td></td><td>User ID controlled by request parameter with data leakage in redirect</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/user-id-controlled-by-request-parameter-with-data-leakage-in-redirect">user-id-controlled-by-request-parameter-with-data-leakage-in-redirect</a></td></tr><tr><td></td><td>User ID controlled by request parameter with password disclosure</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/user-id-controlled-by-request-parameter-with-password-disclosure">user-id-controlled-by-request-parameter-with-password-disclosure</a></td></tr><tr><td></td><td>Insecure direct object references</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/insecure-direct-object-references">insecure-direct-object-references</a></td></tr><tr><td></td><td>URL-based access control can be circumvented</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/url-based-access-control-can-be-circumvented">url-based-access-control-can-be-circumvented</a></td></tr><tr><td></td><td>Method-based access control can be circumvented</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/method-based-access-control-can-be-circumvented">method-based-access-control-can-be-circumvented</a></td></tr><tr><td></td><td>Multi-step process with no access control on one step</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/multi-step-process-with-no-access-control-on-one-step">multi-step-process-with-no-access-control-on-one-step</a></td></tr><tr><td></td><td>Referer-based access control</td><td></td><td><a href="https://893354516-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FG6G1cvqyy0thO2CqEubO%2Fuploads%2FIR4tgTll2vONjZ7wLQeA%2Flab.jpg?alt=media&#x26;token=0e60202e-e017-44e5-9846-9b7bdbe74a74">lab.jpg</a></td><td><a href="access-control/referer-based-access-control">referer-based-access-control</a></td></tr><tr><td></td><td></td><td></td><td></td><td></td></tr><tr><td></td><td></td><td></td><td></td><td></td></tr></tbody></table>
