Asymmetric Authorization: Finding Access-Control Defects by Comparing Sibling Operations in Open-Source Web Applications

Abstract

Broken access control is ranked first in the OWASP Top 10:2025, and commodity SAST and DAST scanners cannot verify its correctness. A scanner can tell that a check is missing. It cannot tell whether a check that is present is the right one. This paper describes a practical way to find such defects in source code: compare the authorization applied to sibling operations on the same resource (read and write, list and item, one route prefix and another). An operation guarded more weakly than its siblings is treated as a candidate defect. Each candidate is then checked for features working as designed, code absent from the shipped release, and fields that can be written but are never used. The results cover 104 of the author's coordinated-disclosure reports, those recorded individually in the disclosure record frozen on 4 August 2026, across 88 products; 66 of the reports carry an authorization-related CWE. In late September 2026, maintainers had confirmed 18 of the 108 findings they contain, rejected 8 and closed 5 as duplicates; 9 had maintainer engagement with no outcome established for the report, and 68 had no maintainer response on record. Three patched, publicly disclosed cases, one of them from the 104, are described in detail, plus one critical finding outside the method's scope.