ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications

1. Introduction

• Broken access control is an application-specific principal-resource authorization relation, unlike injection’s shared dataflow pattern, and a route is vulnerable when that relation is unenforced or incorrect.Static analyzers can match conventional framework guards, but cannot determine from the pattern alone whether the guard is right for the returned object.Source: §1 · p. 2
• ABSENTIA maps routes and guards into a graph, then audits routes one at a time by inferring intended invariants and checking whether code enforces them.A failed invariant becomes a finding for a security reviewer to verify.Source: §1 · p. 3
• ABSENTIA recalls 19 of 30 broken access control vulnerabilities, 17 under patched-commit differential, at 51% verifier-adjudicated precision; CodeQL and Semgrep recall none, while an unstructured agent recalls 3.The unstructured agent uses the same model.Source: §1 · p. 3
• On OWASP Benchmark injection categories, ABSENTIA leads the evaluated tools in Python and trails only CodeQL and IRIS in Java.The paper attributes detection to recovering each route’s intended property and treating it as a claim to falsify.Source: §1 · p. 3
• BAC-BENCH contains 30 disclosed advisories across 25 repositories, 3 languages, and 9 frameworks, human-verified and paired with fixing commits.Instances were published in 2025 or later, and scoring credits findings on vulnerable versions but not fixed ones.Source: §1 · pp. 3–4
• Per-route decomposition accounts for recall, while invariant falsification reduces report volume by a third without reducing recall.The paper also reports costs and the share of previous computations reusable after a repository commit.Source: §1 · p. 4

2. Background

• Common flaws such as injection share a language-level pattern: request input reaches a dangerous operation unchecked, which taint analysis can trace.The paper contrasts these with application-specific flaws that require a model of intended behavior.Source: §2 · p. 4
• Broken access control is a failure of the application-specific relation specifying which principals may act on which resources.Taint analysis can identify request-derived data reaching a sensitive operation but does not encode whether that operation is permitted for that principal and resource.Source: §2 · p. 4
• Authorization can fail because a required check is absent or because a present check enforces the wrong principal, resource, role, or scope.A guard’s presence alone does not establish that it implements the intended policy.Source: §2 · p. 4

3. Motivation

• Authorization defects are application-specific relations between a principal and a resource, unlike injection defects defined by reusable language-level flow rules.A check can be wrong even when present if it enforces the wrong relation.Source: §3 · p. 4, §3.1 · p. 5

3.1. Setting and Scope

• ABSENTIA is a source-only audit for maintainers that detects unauthorized access by authenticated, low-privilege principals without exploiting the application.It reports the request that would violate policy for maintainer review.Source: §3.1 · p. 5

3.2. Two Vulnerabilities Behind One Guard

• A shared login guard can block neither SQL injection nor cross-account invoice access when the query uses an untrusted parameter or omits ownership validation.In the invoice example, any authenticated user can read another account’s invoice by supplying its identifier.Source: §3.2 · p. 5

3.3. Obstacles and Requirements

• Application-specific policies prevent reusable rules from determining whether a route’s check is correct, while absence of a check may depend on the whole request surface.Framework conventions also vary across the benchmark’s nine frameworks and three languages.Source: §3.3 · pp. 5–6
• An unstructured agent lacks systematic coverage and a stable standard for judging routes, while authentication bypass and infrastructure compromise fall outside ABSENTIA’s scope.The benchmark applications expose a median of 220 routes and as many as 999; the unstructured same-model agent detects 3 of 30 advisories.Source: §3.1 · p. 5, §3.3 · p. 6
• ABSENTIA’s three requirements are to map the request surface, inspect routes systematically, and infer each route’s intended property before checking enforcement.Findings are framed as requests that would violate the property.Source: §3.3 · p. 6

4. Design

• ABSENTIA’s design maps the request surface, analyzes routes individually, links cross-route findings, and reuses unaffected verdicts across commits.The graph settles what will be analyzed before in-depth code reading.Source: §4 · p. 6, Figure 2 · p. 7

4.1. Mapping the Application

• The graph records route declarations, handlers, authorization checks, request values, and sensitive operations with their file and line locations.Profiling establishes the framework, data stores, query libraries, authentication libraries, and application-specific access policy; extraction then identifies expressions and files for graph elements.Source: §4.1 · pp. 7–8
• Two independently produced extraction reports are unioned before matches are added to the graph and routes are expanded by HTTP method.A route missed by the patterns is absent from later stages, motivating the union of reports.Source: §4.1 · p. 9

4.2. Per-Route Invariant Falsification

• For each route, an agent follows its handler into services and data models, enumerates intended properties, locates enforcement, and constructs requests that would violate them.Findings include the candidate invariant, relevant code, request shape, preconditions, and demonstrating effect.Source: §4.2 · p. 9

4.3. Composition Across Routes

• Cross-route composition pairs findings and capabilities located in shared files for an agent to assess against both routes and their shared code.An upload that stores a caller-chosen filename may combine with a route that serves stored files to create a risk neither route reveals alone.Source: §4.3 · pp. 9–10

4.4. Re-Analyzing After a Commit

• A prior route verdict is reused only when its dependency files are unchanged and none appears in the commit diff.The dependency set includes imports declared by the files used to reach other code.Source: §4.4 · p. 10

5. BAC-BENCH

• BAC-BENCH contains 30 human-validated advisories from 25 open-source projects, each paired with the vulnerable commit and the commit that fixed the defect.Instances are selected from Python, JavaScript, and TypeScript web applications, with advisories published in 2025 or later.Source: §5 · p. 10, §5.1 · p. 10

5.1. Construction

• The benchmark oracle records the intended invariant, defect, affected routes, and locations named by the advisory and fix.It also maps changed fix lines back to the vulnerable code to distinguish findings at the defect from those merely nearby.Source: §5.1 · pp. 10–11
• Table 1 summarizes instance composition by the first assigned CWE class, language, and scale.The instances span nine frameworks and include both missing checks and checks bound to the wrong principal, object, or scope.Source: Table 1 · p. 11, §5.1 · p. 11
• Evaluation asks whether each advisory’s named bug is reported on its vulnerable commit and not reported on its fixed commit.Because repositories may contain undisclosed defects, other findings are neither credited nor penalized, and precision is measured separately.Source: §5.1 · p. 11

5.2. Adjudication

• Adjudication filters findings by implicated files or affected routes, then uses a blinded language-model judge to compare candidates against the oracle.The judge reads the finding but no repository source; a security researcher agreed with it on 81 of 85 checked adjudications (Cohen’s κ = 0.91).Source: §5.2 · pp. 11–12

6. Implementation

• ABSENTIA runs each stage as a Strands agent over MiniMax-2.5, while other models handle adjudication, precision verification, and stronger-reader comparison.The experiments use AWS Bedrock, but the method does not depend on that service.Source: §6 · p. 12
• Route-level reasoning uses temperature zero, while graph extraction unions reports from two agents run at temperatures 0.1 and 0.7.The extraction passes are varied so a route missed by one may be recovered by the other.Source: §6 · p. 12
• ABSENTIA reads source files, lists directories, searches for expressions, and resolves declared imports, but does not run the application.This read-only access is confined to the repository directory.Source: §6 · p. 12

7.1. Experimental Setup

• The evaluation uses BAC-BENCH for access control and OWASP injection subsets for generalization, comparing ABSENTIA with static analyzers and model-driven baselines.BAC-BENCH contains 30 advisories across 25 applications; the OWASP subsets include 10 Python and 6 Java injection categories, with safe cases enabling false-positive measurement.Source: §7.1 · pp. 12–14

7.3. Broken Access Control Detection (RQ1)

• ABSENTIA detects 19 of 30 disclosed vulnerabilities, versus none for CodeQL and Semgrep and 3 for Plain LLM-Agent; paired recall is 17.Paired recall credits detections only when the defect is reported on the vulnerable commit and cleared on the patched commit.Source: Table 2 · p. 14, §7.3 · pp. 14–15
• 27 vulnerable routes reach the reasoning stage, where 19 are detected; reasoning accounts for 8 of 11 misses, while extraction accounts for 3.Across weakness classes, reasoning loses more routes than extraction; the three unrecovered routes span three frameworks with no common cause.Source: Figure 4 · p. 15, §7.3 · p. 15
• Six of eight smaller instances return identical verdicts across five runs; recall is 0.68 for one run, 0.75 if any run detects, and 0.50 if all must.The stability study covers only instances below 100 routes; it does not establish stability for larger repositories.Source: Table 3 · p. 16, §7.3 · p. 16

7.4. Component Contributions (RQ2)

• Per-route decomposition raises recall from 3/30 to 18/30; invariant falsification cuts reports by one-third and raises verified precision from 40.5% to 50.8%, with a one-instance recall difference within run-to-run variation.Sonnet-5 reports 22 of 27 localized instances versus MiniMax-2.5’s 19, but loses an instance MiniMax-2.5 reports; this gain is also within repeated-run variation.Source: Table 4 · p. 17, §7.4 · p. 18
• The verifier’s confirmed share rises from 40.5% to 50.8%, but a blinded reviewer’s 42% and 43% rates do not confirm that gap.The authors therefore report the precision gain as measured by the verifier, not as a quantity established by the expert sample.Source: §7.4 · p. 17, Table 5 · p. 17

7.5. Generalization Beyond Access Control (RQ3)

• On injection benchmarks, ABSENTIA leads the baselines in Python at Youden’s J of 0.43 versus IRIS’s 0.24, while CodeQL leads in Java at 0.49 versus ABSENTIA’s 0.37.ABSENTIA’s true-positive rates are 0.85 in Python and 1.00 in Java, with false-positive rates of 0.42 and 0.62, respectively.Source: Figure 5 · p. 18, §7.5 · p. 19

7.6. Cost and Continuous Analysis (RQ4)

• A median run costs $44, and re-analysis reuses 37% of routes; 9 instances reuse at least 70%, while 8 reuse none.Scoring the vulnerable commit after re-analysis finds vulnerabilities in 21 of 30 instances at both 95% and 0% reuse, with no observed detection penalty.Source: §7.6 · p. 19, Figure 6 · p. 20

Verification effort

• ABSENTIA leaves about 77 findings per benchmark instance, and reviewers must read them all—about two per confirmed defect—with no useful ordering from its confidence scores.The verifier confirms about half of the findings.Source: §8 · p. 20

Extraction coverage

• A graph covers only routes recovered by extraction, so a route missed by its patterns is absent from every later analysis stage.Source: §8 · p. 20

Nondeterminism

• Temperature-zero judgments and two extraction passes narrow variation, but ABSENTIA remains nondeterministic and cannot match static analyzers’ reproducibility.Across repeated trials, detection was mostly a property of the instance rather than the draw.Source: §8 · p. 20

Exposure to the advisories

• The authors treat BAC-Bench as outside the model’s training data because its advisories postdate the family’s documented June 2025 cutoff, but cannot establish that assumption.Source: §8 · p. 20

Cost

• Analysis costs a median of $44 per repository and up to $316 on the largest; a median commit reuses 37% of unaffected route verdicts.The compared analyzers have no per-run cost, while reuse offers a way to reduce ABSENTIA’s cost on re-analysis.Source: §8 · pp. 20–21

Scope of the evidence

• BAC-Bench covers 30 vulnerabilities but no advisory requires chained routes, so its recall does not evaluate cross-route composition as an adjudicated capability.ABSENTIA composed 42 route pairs; 13 were in the verification sample, and about half were confirmed, so composition is reported as a pipeline feature.Source: §8 · p. 21

Detecting vulnerabilities in web applications

• Taint analyzers detect bugs defined as untrusted-input flows, but broken access control lacks a portable policy definition and existing detectors obtain policy from specifications, comparable operations, or fixed relations.Source: §9 · p. 21
• Runtime authorization tests replay requests under another principal’s session, requiring deployment, role-specific accounts, and a way to reach each check [10].Source: §9 · p. 21

Language models

• Language-model hybrids pair model inference with static analysis by generating taint specifications, filtering findings, or compressing repository context into a code property graph [23] [20].Source: §9 · p. 21

Agents

• Repository-auditing agents reason over code to reach bugs without predefined patterns, but the closest cited discovery system, Co-RedTeam, has no obtainable or runnable implementation [15] [22] [16].Source: §9 · p. 21
• Penetration-testing agents plan attack chains against running deployments, whereas ABSENTIA audits source owned by its users before deployment [8] [36].Source: §9 · p. 22

• On BAC-Bench, ABSENTIA reports 19 vulnerabilities, compared with none for the static analyzers and 3 for an unstructured agent using the same model.Source: §10 · p. 22
• Recovering intended properties from application code lets one unchanged configuration address both application-specific broken access control and language-defined injection.Source: §10 · p. 22

Ethical Considerations

• The evaluation covers open-source applications with previously disclosed-and-fixed benchmark flaws and synthetic injection suites; ABSENTIA reads source without executing apps or collecting user data.The benchmark instances had been publicly disclosed and fixed before the study began.Source: Ethical Considerations · p. 23
• The remainder of ABSENTIA’s extra findings is untriaged and withheld from maintainers; the authors treat these reports as candidates, not vulnerabilities, pending expert review.The authors intend to review the highest-confidence findings and disclose those that survive through each project’s stated security channel.Source: Ethical Considerations · p. 23
• One security graduate researcher performed manual validations under blinding, with no external participants recruited or compensated.The reviewer lacked access to the verdict under review and to the tool or configuration that produced each finding.Source: Ethical Considerations · p. 23
• ABSENTIA is intended for research and audits of code the user owns or is authorized to review, despite acknowledged potential for malicious repurposing.The authors ask users to use it accordingly.Source: Ethical Considerations · p. 23

A. The Benchmark Instances

• Table 7 lists all 30 authorization-benchmark instances individually; §5 characterizes them in aggregate.The table groups instances by implementation language.Source: A. The Benchmark Instances · p. 28, Table 7 · p. 28
• The 30 instances are grouped by implementation language.Source: Table 7 · p. 28
• The advisories were published from July 2025 to June 2026.Source: Table 7 · p. 28

B. Injection Under Sonnet-5

• The authorization benchmark cannot distinguish whether false positives arise from inspecting every route or from model reading, because real applications lack safe cases for estimating that rate.Source: B. Injection Under Sonnet-5 · p. 29
• 798 findings under Sonnet-5 versus 1,258 under MiniMax-2.5 across the injection suite; the paper describes the lower false-positive rate as a better-discriminated set.Source: B. Injection Under Sonnet-5 · p. 29
• Both runs enumerated 2,463 routes and were scored on the same 677 injection cases; the model differed.The Python rerun used Claude Sonnet-5 at every model-driven stage instead of MiniMax-2.5.Source: B. Injection Under Sonnet-5 · p. 29