Business Logic Flaws and Broken Access Control

Overview

Scanners miss most business logic flaws. These bugs come from rules the business cares about—pricing, approvals, entitlements, and workflow order—not from a missing encode call.

What You Will Learn

• Broken access control patterns

• Logic hunt ideas

• Reporting for impact

Broken access control patterns

• Horizontal: access another user’s objects

• Vertical: reach admin functions as a normal user

• Context: perform step C without completing steps A and B

• Tenant isolation failures in multi-tenant SaaS

Logic hunt ideas

• Replay requests out of order

• Remove or duplicate steps in multi-page flows

• Combine features in unintended ways (invite + role change + export)

• Test negative quantities, boundary prices, and conflicting state transitions

• Compare client-side enforcement vs server-side enforcement

Reporting for impact

• Explain the business rule that was broken in plain language

• Show two-account or two-role evidence

• Recommend server-side invariant checks and authorization middleware

Conclusion

Use this guide only on systems you are authorized to test. At SapiensHack, we focus on clear methodology, solid notes, and findings that help teams fix real risk—not noisy scanner output.

If you want related reading, browse the matching category in the sidebar and continue the series from there.