Issue Details
Broken Function Level Authorization
api05-2019 • Rank #5 in OWASP 2023
Explanation
Function-level authorization failures occur when API routes enforce authentication but not permission boundaries for privileged actions. Attackers with low-privilege accounts invoke admin-only methods by guessing routes or manipulating HTTP methods. In distributed APIs, mismatched role checks across services make this risk persistent and hard to detect.
Remedy
Use centralized policy enforcement for route and action authorization, not scattered inline checks. Define permission matrices for every endpoint and HTTP method. Add automated authorization tests for role escalation paths and enforce deny-by-default behavior for unknown or unmapped permissions.
| Year | Rank | Category |
|---|---|---|
| 2019 | #5 | api05-2019 - Broken Function Level Authorization |