Broken access control is one of the most frequent security issues that can damage web applications. It happens if a system fails to effectively restrict user permissions, misconfigurations, or insufficient validation of user, enabling users to get into sensitive data or features that they should not have access to it, which often results to unauthorized actions, leaks of information, and serious risks to both users and organizations. This review provides a comprehensive analysis of the root causes and technical mechanisms behind broken access control vulnerabilities, categorizing their common forms and implications. Furthermore, this review contains a section that is dedicated to comparing innovative approaches that aim to detect and prevent broken access control vulnerabilities, we highlight their strengths, limitations, and their effectiveness through real-world applications and also the review present how these approaches can be adapted to emerging threats. The results are intended to help developers, security researchers, and IT managers, especially in small and large companies, and to suggest future research paths to strengthen access control mechanisms.