API5:2023 — Broken Function Level Authorization
Verified by Precogs Threat Research
What is Broken Function Level Authorization?
APIs with complex access control policies where administrative or privileged functions are accessible to regular users. Often involves changing HTTP method (GET to PUT/DELETE) or modifying URL paths to access admin endpoints.
Impact
Enables unauthorized access to administrative functions: deleting users, modifying configurations, accessing audit logs, or bypassing approval workflows.