Preliminary research

ABSENTIA: Detecting Broken Access Control Vulnerabilities in Web Applications

André Vicente Duarte, Aditya Oke, Rui Melo, Shubham Gandhi, Nachiket Kotalwar, Charmi Khandor, Danqing Wang, Arlindo L. Oliveira, Carolyn Rosé and Lei Li · arXiv · 1 October 2026

AI-collected research leads through 3 November 2026, including a November–October–September missed-article review and a targeted multilingual search alongside earlier community-source sweeps. Unranked, incomplete, not community-vetted, and subject to change.

Maps web routes to source code and infers authorization invariants for source-only audits. Evaluates per-route analysis using vulnerable/fixed advisory pairs in BAC-Bench; reports coverage and human-review limits.

Record

Researcher

André Vicente Duarte, Aditya Oke, Rui Melo, Shubham Gandhi, Nachiket Kotalwar, Charmi Khandor, Danqing Wang, Arlindo L. Oliveira, Carolyn Rosé and Lei Li

Published by

arXiv

Date

1 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Code and benchmark

Tags

• access-control
• llm
• static-analysis
• methodology

This page is the archive's own catalogue record. The research is the work of André Vicente Duarte, Aditya Oke, Rui Melo, Shubham Gandhi, Nachiket Kotalwar, Charmi Khandor, Danqing Wang, Arlindo L. Oliveira, Carolyn Rosé and Lei Li, first published at the original source. Preserved copies are kept so the citation survives its host.