API5:2023 â Broken Function Level Authorization Â· Slide 9 of 28

Slide 9 · Two Attack Patterns

Find the function. Call it with the wrong role.

Discovery and exploitation — the two stages of a BFLA attack.

Pattern 1: Role Bypass

The function is known — role check is missing

Attacker knows the admin endpoint (from app traffic, docs, or guessing)

Calls it with a regular user token

API validates token, but never checks role

Admin function executes

Example: Bumble premium endpoints accept free-tier tokens

Pattern 2: HTTP Verb Manipulation

Same endpoint — different methods, different auth

GET /api/posts/123 — anyone can read (authorized)

DELETE /api/posts/123 — only admins can delete (not checked)

Regular user changes GET to DELETE

Object ownership check passes; function check doesn’t exist

Post deleted by a non-admin

Why verb manipulation is so common

A developer who adds role checks to GET may forget to add them to DELETE, PUT, or PATCH on the same path. The URL is the same — the attacker just changes the method. If authorization only checks the URL (not the method + URL combination), the wrong method slips through.

← Back Pattern 1: Role bypass in detail →