API5:2023 — Broken Function Level Authorization
Verified by Precogs Threat Research
What is Broken Function Level Authorization?
APIs with complex access control policies where administrative or privileged functions are accessible to regular users. Often involves changing HTTP method (GET to PUT/DELETE) or modifying URL paths to access admin endpoints.
Impact
Enables unauthorized access to administrative functions: deleting users, modifying configurations, accessing audit logs, or bypassing approval workflows.
How Precogs AI Addresses API5
Precogs AI detects missing function-level authorization in API code, identifying admin endpoints accessible without proper role verification.