KSA Client Portal Software

OWASP's Top 10 for 2021 lists broken access control first among web application risks, and reports that 94% of the applications tested had some form of it. A client portal is built around access control: each client sees only their own information.

OWASP describes access control as enforcing policy so users cannot act outside their intended permissions. It reports that failures typically lead to unauthorized disclosure, modification or destruction of data, and lists bypassing access control checks by modifying the URL among the common vulnerabilities.

Moosara works only with companies in the United States. If your company is based elsewhere, this page describes the approach, but I cannot take on the work.

OWASP's overview says 94% of applications were tested for some form of broken access control, with an average incidence rate of 3.81% and over 318,000 occurrences in its dataset. For a portal, that means trying each page and each record address as one client and confirming another client's data is not returned.

I build on OAuth 2.0 and JWT authentication with Microsoft Entra ID, and on SQL Server and Azure, with HIPAA and SOC 2 as compliance work I have done.

The U.S. National Vulnerability Database record for CVE-2025-48757 describes an insufficient database row-level security policy that allowed remote unauthenticated attackers to read or write arbitrary database tables of generated sites. Access rules in the database are part of the portal.