Authentication and Authorization Flaws
Authentication and Authorization Flaws covers broken access control, IDOR, and session handling. CWEE tests whether you can prove that an identity can reach data or actions outside its intended boundary, and whether session design creates a bypass.
Model the access-control matrix
List roles, resources, and actions. For each cell, test horizontal access (same role, different object) and vertical access (lower role to higher action). Change identifiers in paths, query strings, JSON bodies, and headers. Try method switches and alternate routes such as /api/users/1 versus /api/v1/admin/users/1. Check whether UUIDs, opaque tokens, or tenant IDs are treated as authorization.
Session handling
Inspect cookie flags, session rotation at login, logout invalidation, and fixation. Test whether a password reset or role change invalidates old sessions. Look for mass assignment when profile updates accept extra fields such as role or is_admin.
Worked example
A request GET /api/accounts/8842/invoices returns only the current user's invoices in the UI. Replaying it with another account ID returns that account's invoice list with a 200. The object identifier is the only control, so this is a horizontal IDOR. Confirm by testing a second unrelated ID and documenting both responses.
Traps
Relying on hidden UI controls is not access control. Assuming UUIDs are safe ignores leaked identifiers in APIs. Treating a 403 as final misses path casing, trailing slashes, and header-based role overrides. Failing to test session invalidation after privilege changes costs marks.