Access control decides who may view, edit, download, or delete information. When it works, each user sees only what they are allowed to see. When it fails, a normal customer may open another person’s invoice, reach a staff page, or change something only an administrator should change.
A simple example
Imagine a portal where each customer can view their own invoice. A well-built site checks two things: the person is logged in, and the invoice belongs to them. A poorly built site may check only that someone is logged in. Changing a number in the address bar should not be enough to open someone else’s file.
Login is not the same as permission
Authentication asks “who are you?” Authorization asks “what are you allowed to do?” Entering a hotel does not mean a guest may open every room. The same idea applies to staff dashboards, file downloads, and refunds.
Mistakes we often see
- Ordinary users can open staff-only pages
- Everyone in the company is an administrator
- Hidden pages that are not linked, but still work if you know the address
- Permissions checked in the browser but not on the server
- Former staff accounts left active
The impact depends on what the site stores. A flaw on a public blog may be inconvenient. The same class of flaw in a shop, clinic portal, or client file area can expose invoices, contracts, or personal details.
What a security test should include
A useful review checks whether one user can reach another user’s records, whether a low-privilege account can perform staff actions, and whether the programming interfaces behind the pages enforce the same rules as the screens people click.
If your website has customer accounts, staff dashboards, or private files, this is one of the first areas CyberX.agency examines.