Security Test: Public state-altering operation¶

Description¶

Default Severity: medium

If a route that changes data is public, anyone can trigger changes without proper checks. This means an attacker might alter or delete data, inject malicious information, or cause unexpected behavior in your application. The vulnerability arises when state-altering operations, like data updates or deletions, aren’t protected by authentication, leaving your system open to abuse. Developers often overlook that securing just the read operations isn’t enough, which can lead to serious security breaches, data loss, and a loss of trust if attackers exploit these unguarded endpoints.

Reference:

• https://owasp.org/Top10/A01_2021-Broken_Access_Control/

Configuration¶

Identifier: access_control/public_state_altering_operation

Examples¶

All configuration available:

checks:
  access_control/public_state_altering_operation:
    skip: false # default

Compliance and Standards¶