Broken Function Level Authorization
BFLA occurs when APIs fail to properly enforce authorization at the function level. Regular users can access admin endpoints, or lower-privilege users can invoke higher-privilege operations by directly calling the API.
Overview
Broken Function Level Authorization occurs when applications do not properly restrict access to API functions based on user roles. Attackers can discover and invoke administrative or privileged endpoints by analyzing client-side code, API documentation, or simply guessing URL patterns (e.g., changing /api/users to /api/admin/users).
Impact
Administrative access bypass, unauthorized operations, privilege escalation, data manipulation.
Examples
Admin Endpoint Access
Regular user calls: GET /api/admin/users DELETE /api/admin/users/1002
Remediation
Implement centralized authorization middleware, deny by default, enforce role checks on every endpoint, and audit all administrative functions.
Implement centralized authorization checks
Deny access by default, require explicit grants
Enforce role-based access on every API endpoint
Do not rely on client-side access control
Regularly audit admin and privileged endpoints
Related SuperClue scanner checks
These scanner checks look for signs of Broken Function Level Authorization. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works