An admin API has an endpoint at /api/v1/users. The intended behavior: GET /api/v1/users returns a list of users (admin-only). No other methods were intentionally implemented on this endpoint.
The web framework automatically maps HTTP methods to controller methods. A developer had defined a deleteAll() method in the controller during development as a testing utility. The method was never exposed in the documentation — but the framework routes DELETE /api/v1/users to it because the method exists.
OPTIONS /api/v1/users. The server responds with Allow: GET, DELETE, OPTIONS — advertising all accepted methods. The attacker sends DELETE /api/v1/users. The framework routes it to deleteAll(). All user records are deleted. The delete method has no authorization check because it was never meant to be in production.The HTTP OPTIONS method is designed to report which methods a server accepts on an endpoint. Attackers routinely send OPTIONS requests to API endpoints as a first reconnaissance step — it’s a free map of what the endpoint can do. Disabling OPTIONS (or not returning the Allow header) is a defense; restricting endpoints to only the methods they need is the fix.