# A01 Broken Access Control

> Skills for testing broken access control vulnerabilities including IDOR, CSRF, CORS misconfigurations, and open redirects per OWASP A01:2021.

- Skill: `omkar-ukirde/a01-broken-access-control` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add omkar-ukirde/a01-broken-access-control`
- Raw SKILL.md: https://api.skillmd.com/api/skills/omkar-ukirde/a01-broken-access-control/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: omkar-ukirde (https://skillmd.com/u/omkar-ukirde)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/omkar-ukirde/a01-broken-access-control

---


# Broken Access Control (OWASP A01)

Access control enforces policy such that users cannot act outside their intended permissions.

## Skills

- [IDOR](references/idor.md) - Insecure Direct Object Reference exploitation
- [CSRF](references/csrf.md) - Cross-Site Request Forgery attacks
- [CORS Bypass](references/cors-bypass.md) - CORS misconfiguration exploitation
- [Open Redirect](references/open-redirect.md) - URL redirect manipulation

## Quick Reference

| Attack | Risk | Detection |
|--------|------|-----------|
| IDOR | High | Modify object IDs in requests |
| CSRF | Medium | Check for missing/weak tokens |
| CORS | Medium | Test Origin header reflection |
| Open Redirect | Low-Medium | Test redirect parameters |