A content platform’s post endpoint handles reads and writes:
• GET /api/v1/posts/{id} — returns a post, available to any user
• PUT /api/v1/posts/{id} — updates the post, restricted to the post’s author
• DELETE /api/v1/posts/{id} — deletes the post, intended for admins only
The developer added an ownership check for PUT (only the author can update their post). DELETE was added later and has no role check — it was assumed to be “internal.”
DELETE /api/v1/posts/5523 with their own (non-admin) auth token. The API validates the token (valid), routes to the delete handler, finds no role check or ownership check for DELETE, and removes the post. Any user can now delete any post on the platform — including content they never created.It is extremely common to add ownership checks for PUT but forget them for DELETE. The consequences of an unauthorized DELETE are usually worse — deletion may be irreversible. The methods that cause the most damage are often the least protected.