“Complex access control policies with different hierarchies, groups, and roles, and an unclear separation between administrative and regular functions, tend to lead to authorization flaws. By exploiting these issues, attackers can gain access to other users’ resources and/or administrative functions.”
• Administrative functions accessible to regular authenticated users without role checks.
• Distinction between admin and regular endpoints relies on path obscurity or UI hiding rather than server-side enforcement.
• Different HTTP methods on the same endpoint have inconsistent authorization — only some methods are protected.
• The API checks who you are (authentication) but not what you can do (authorization).
The underlying weakness: “The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.” The actor is authenticated — the failure is checking whether that actor’s role entitles them to call this specific function.