domains / families / security / exploiting-broken-function-level-authorization

exploiting-broken-function-level-authorization

separate

Tests APIs for Broken Function Level Authorization (OWASP API5:2023) by identifying admin and privileged endpoints, then reaching them with regular-user credentials via HTTP method switching, URL path manipulation, and parameter tampering. Use when testing whether low-privilege users can invoke admin API functions or otherwise escalate privileges via function-level access control gaps.

When to use

• Testing whether regular users can access administrative API endpoints by direct URL access
• Assessing APIs for vertical privilege escalation where users can invoke functions above their role
• Evaluating if API gateways and middleware consistently enforce function-level access controls
• Testing role-based access control (RBAC) implementation across all API endpoints and HTTP methods
• Validating that API documentation does not expose admin endpoint paths that lack authorization

When not to use

• Use without written authorization

Skill page

Source