OWASP API #5 — Broken Function Level Authorization (BFLA): When Users Can Perform Actions They…

Imagine an online banking application where a normal user can view their account balance but should never be able to delete transactions or modify another customer's account.

Now imagine an attacker intercepts an API request and changes the HTTP method or endpoint to access an administrator-only function.

If the API executes that request without verifying the user's permissions, you've encountered Broken Function Level Authorization (BFLA).

What is Broken Function Level Authorization?

Broken Function Level Authorization occurs when an API fails to verify whether a user has permission to perform a specific action.

Unlike BOLA, which focuses on what data a user can access, BFLA focuses on what actions a user can perform.

Common examples include:

• Accessing admin endpoints as a normal user
• Changing account type without payment
• Deleting other users' data
• Resetting another user's password
• Executing privileged API functions

Real-World Breach: Bumble

Bumble offered both Free and Premium accounts.

The application had an API endpoint that allowed users to check their account type.

However, another API function allowed the account type to be modified directly.

A researcher discovered that by sending a modified API request, a free account could be upgraded to a premium account without making any payment.

The issue occurred because the API failed to verify whether the user was authorized to execute that function.

How Attackers Exploit It

Attackers often look for hidden or privileged API functions.

Typical attack flow:

• Intercept API requests using Burp Suite.
• Identify sensitive endpoints.
• Change HTTP methods (GET → POST, PUT, DELETE).
• Access admin-only endpoints directly.
• Modify request parameters.
• Observe whether unauthorized actions succeed.

How Pentesters Should Test

• Enumerate all API endpoints using Burp Suite.
• Test every endpoint with different user roles.
• Attempt to access admin APIs using a low-privileged account.
• Change HTTP methods and observe server behavior.
• Test whether unauthorized users can create, update, or delete resources.
• Verify whether backend authorization is enforced on every sensitive function.
• Compare permissions between Guest, User, Moderator, and Admin accounts.
• Look for hidden endpoints exposed in API documentation or JavaScript files.

Prevention & Best Practices

• Enforce authorization checks on every API function.
• Implement Role-Based Access Control (RBAC).
• Never rely on the frontend to restrict functionality.
• Apply the Principle of Least Privilege.
• Remove unused or deprecated admin endpoints.
• Regularly test authorization controls for every user role.
• Log and monitor unauthorized access attempts.

This is Part 5 of my OWASP API Security Top 10 series.

In the next blog, we'll explore OWASP API #6 — Unrestricted Access to Sensitive Business Flows, where we'll learn how attackers abuse legitimate business logic to perform unintended actions.

Until then, feel free to connect with me on LinkedIn:

www.linkedin.com/in/narmadha-natarajan07

Thank you for reading !