API5:2023 â Broken Function Level Authorization Â· Slide 10 of 28

Slide 10 · Role Bypass

The token is valid. The role check doesn’t exist.

How a regular user calls admin functions when the API only checks authentication.

The Setup

An API has user-facing and admin endpoints. Authentication middleware runs on all of them — every request must have a valid JWT. But the admin endpoints have no additional role check. The middleware confirms “this is a real token” and passes the request through. The admin function executes without ever asking “does this user’s role include admin access?”

# Vulnerable: auth check runs, but no role check follows @app.route('/api/admin/users', methods=['GET']) @require_auth # checks token is valid def list_all_users(): # No role check — any authenticated user reaches this return db.query("SELECT * FROM users") # Fixed: auth + role check @app.route('/api/admin/users', methods=['GET']) @require_auth @require_role('admin') # checks user.role == 'admin' def list_all_users(): return db.query("SELECT * FROM users")

How the attacker finds it

A free Bumble account uses the app normally while watching API traffic in a proxy. They see premium features return “upgrade required.” They try calling the same endpoint with their free token directly — the upgrade check only lived in the UI, not the API. They also try /api/v1/premium/, /api/admin/ — any returning 200 instead of 403 is a BFLA.

← Back Real incident: Bumble →