The authoritative source for the definition, vulnerable patterns, example attack scenarios, and prevention guidance in this module. The three attack scenarios on slides 14–16 are drawn directly from the OWASP API5 page (admin URL discovery, HTTP verb manipulation, workflow bypass). CWE reference: CWE-285 (Improper Authorization). This course is an independent study companion — not affiliated with or endorsed by OWASP.

Security researcher Sanjana Sarda at Independent Security Evaluators discovered that Bumble’s API checked for a valid session token on every request but did not verify whether the calling user’s subscription tier or role authorized them to use specific functions. Free-tier users could access Bumble Boost premium features (see who swiped right, extend matches, re-match expired connections) and certain administrative functions by calling the API endpoints directly. The vulnerability affected Bumble’s 100+ million registered users. Sarda reported the findings to Bumble in June 2020. After receiving no remediation timeline after five months, ISE published their findings publicly in November 2020. Referenced in slides 1, 10, 11, 20, 26.

Security researcher Nir Ohfeld at Rapid7 discovered that a GraphQL query to GitLab’s /api/graphql endpoint — which enumerated registered users, usernames, and email addresses — required no authentication and was not restricted to admin-role tokens. On GitLab.com, this exposed the personal details of millions of users to any unauthenticated caller. GitLab patched CVE-2021-4191 in versions 14.7.7, 14.8.5, and 14.9.2, adding authentication requirements and restricting user enumeration to administrator-role tokens. Self-hosted instances remained exposed until patched. Referenced in slides 13, 22, 26.

Implementation guidance on role-based access control, permission matrices, centralized authorization enforcement, and deny-by-default patterns. Directly informs MIT 01 through MIT 05 in this module.

OPA is a widely-used policy engine for centralizing authorization logic across microservices. Relevant to MIT 04 (centralized authorization): instead of embedding role checks in every handler, each service asks OPA “is this token permitted to call this action?” OPA evaluates the policy and returns allow/deny. This ensures authorization is consistent across all services.

Technical guidance on implementing per-resolver authorization in GraphQL APIs. Covers the risk of unauthenticated introspection, the need to authorize each resolver individually (not just the top-level query), and patterns for centralized GraphQL authorization middleware. Directly relevant to the GitLab incident (slides 13, 22).

The full published report from Sanjana Sarda and ISE covering the Bumble API vulnerabilities in detail, including methodology, specific endpoints affected, and remediation recommendations. Search for “ISE Bumble API security evaluation 2020” to find the published report.

Interactive labs covering vertical privilege escalation (regular user accessing admin functions), horizontal privilege escalation (BOLA), and multi-step access control bypasses. Recommended hands-on practice for BFLA after completing this module.