Function-level authorization failures occur when API routes enforce authentication but not permission boundaries for privileged actions. Attackers with low-privilege accounts invoke admin-only methods by guessing routes or manipulating HTTP methods. In distributed APIs, mismatched role checks across services make this risk persistent and hard to detect.
Use centralized policy enforcement for route and action authorization, not scattered inline checks. Define permission matrices for every endpoint and HTTP method. Add automated authorization tests for role escalation paths and enforce deny-by-default behavior for unknown or unmapped permissions.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2019Latest
#05api05-2019 Broken Function Level Authorization
