DRHL: Cross-Language Detection and Repair of Access Control Vulnerabilities via Hybrid Analysis and LLMs

Broken Access Control (BAC) enables unauthorized resource access, posing critical risks. Traditional detection suffers from inefficiency and high false positives, while existing repairs are largely manual, PHP-centric, and low success rates. To address this, we propose DRHL, a cross-language framework for automated BAC detection and repair grounded in the Role-Based Access Control (RBAC) model. DRHL constructs a Hybrid Site Navigation Graph (HSNG) via dynamic-static analysis to map roles, permissions, and pages, enabling precise inference and targeted payload generation that curbs redundancy and false positives. For repair, it extracts access control snippets from multilingual applications under syntactic-semantic constraints and encodes them with detection results into prompts, guiding a Large Language Model (LLM) to generate context-aware, style-consistent patches across languages. Evaluations on 16 web applications across PHP, Java, Python, and Go show that DRHL detects all 50 independently established ground-truth vulnerabilities with only 1 FP and 0 FNs, and repairs 48 of them within three attempts. It also improves average code coverage over ZAP and Burp Suite by 3.89 and 9.77 percentage points, respectively, at comparable runtime, while 94.68% of expert patch-quality ratings are positive across Access-Control Correctness, Functionality Preservation, and Code Quality.