API5:2023Broken Function Level Authorization
Slide 26 of 28
Part 4 · PreventionSlide 26
Slide 26 · The Matrix
Which mitigations stop which attacks?
Real incidents and scenarios mapped to the defenses that would have stopped them.
BREACH — Bumble (2020) · 100M+ users · Role Bypass
Free users called premium and admin endpoints — no subscription or role check

Authentication ran on every request. Authorization (subscription tier or admin role) was never checked. Any user could call any endpoint by calling the API directly.

Stopped by: MIT 02 (RBAC: premium endpoints require subscription_tier=boost) + MIT 01 (deny by default: new endpoints denied until explicitly permitted) + MIT 06 (test: negative auth test would have caught free user calling premium endpoint)
BREACH — GitLab (2021) · Millions of users · Unauthenticated Function
GraphQL resolver enumerated all users without requiring any token

A GraphQL resolver for user enumeration had no authentication or authorization requirement. Any caller could retrieve usernames, emails, and user IDs for every account on the instance.

Stopped by: MIT 01 (deny by default: unauthenticated callers denied unless explicitly permitted) + MIT 04 (centralized: authorization middleware on every GraphQL resolver) + MIT 06 (test: unauthenticated call to user enumeration query should return 401 in CI)
OWASP — Admin URL discovery · Privilege escalation · Role Bypass
Regular user called /api/admin/users/all and granted themselves admin role

Admin endpoints were at predictable paths. No role check ran on them. A regular user found the paths in the app bundle and called them directly.

Stopped by: MIT 02 (RBAC: admin endpoints require role=admin) + MIT 03 (method + path: PUT /admin/users/{id}/role requires admin specifically) + MIT 05 (matrix: visible gap when /admin/ paths have no role entry)
OWASP — Verb manipulation · Unauthorized deletion · HTTP Method
User changed GET to DELETE — auth checked the URL, not the method

Authorization checked whether the user could access the URL. It didn’t check whether the user’s role permitted the DELETE method on that URL.

Stopped by: MIT 03 (method + path: DELETE /api/posts/{id} requires admin role separate from GET) + MIT 06 (test: user token calling DELETE /api/posts/{id} should return 403)
← Back Ready to test yourself? →
📄 View sources