Slide 16 of 28
Part 3 · Attack ScenariosSlide 16
Slide 16 · Scenario 3
The non-admin who approved their own account.
OWASP Scenario #3 — a workflow function with a missing role gate.
📄 OWASP API Security Top 10 · 2023 · API5 · Scenario 3
SETUP
A marketplace that requires admin approval for new sellers.

A marketplace platform requires new seller accounts to go through an admin review before they can list products. Sellers register, submit their details, and wait for an admin to approve their account via the admin dashboard.

The approval action calls POST /api/v1/sellers/{id}/approve. This endpoint is intended only for admins. But the admin dashboard was built quickly and the developer used the same API token model as user-facing endpoints — the approve endpoint only checks for a valid auth token, not an admin role.

The exploit: A new seller registers and receives a regular user token. During the review period, they call POST /api/v1/sellers/1234/approve with their own user ID and their own token. The API validates the token (valid), finds no role check on the approve endpoint, and marks their account as approved. The seller bypasses the review entirely — and so can every new seller who tries.
Workflow bypass as the impact

This scenario isn’t just about data exposure — it bypasses a business process designed to prevent fraud. Marketplace review processes exist to verify seller legitimacy. A BFLA that lets sellers self-approve eliminates that control entirely, potentially enabling fraudulent sellers to operate unchecked.

← Back What do all these have in common? →