A marketplace platform requires new seller accounts to go through an admin review before they can list products. Sellers register, submit their details, and wait for an admin to approve their account via the admin dashboard.
The approval action calls POST /api/v1/sellers/{id}/approve. This endpoint is intended only for admins. But the admin dashboard was built quickly and the developer used the same API token model as user-facing endpoints — the approve endpoint only checks for a valid auth token, not an admin role.
POST /api/v1/sellers/1234/approve with their own user ID and their own token. The API validates the token (valid), finds no role check on the approve endpoint, and marks their account as approved. The seller bypasses the review entirely — and so can every new seller who tries.This scenario isn’t just about data exposure — it bypasses a business process designed to prevent fraud. Marketplace review processes exist to verify seller legitimacy. A BFLA that lets sellers self-approve eliminates that control entirely, potentially enabling fraudulent sellers to operate unchecked.