Slide 8 of 28
Part 1 · What Is It?Slide 8
Slide 8 · Why It’s #5
A missed check on one endpoint exposes the entire admin surface.
Design-time failures. No wrong check — no check at all.
The Design-Time Problem

BOLA requires a missing check on every request. BFLA requires a missing role check on specific endpoints that were never designed for regular users. The failure happens at design time: the developer builds an admin endpoint, assumes it’s internal-only, and skips the authorization check entirely. There’s no “wrong” check — there’s no check at all.

Why it persists
Admin endpoints built for internal use — authorization feels redundant
Different teams own user API vs. admin API — nobody checks the seam
Role checks added to some endpoints but not others — inconsistent
HTTP verb authorization assumed to match the URL authorization check
Why severity is high
Admin functions are the highest-value target on any platform
One unprotected admin endpoint can expose all user data
Attackers specifically probe admin paths — first thing they try
Financial bypass and mass data exposure from the same class of bug
← Back Show me how it works →