Broken Function Level Authorization (BFLA): How to Find API Privilege Bugs
Broken Function Level Authorization (OWASP API5) is when a lower-privilege user can invoke an admin or internal function. Unlike IDOR/BOLA (wrong object), BFLA is the wrong action — delete all users, export audits, change feature flags — with your own low-privilege token.
Discovery sources
- JavaScript bundles and mobile apps listing
/admin,/internal,/manageroutes - OpenAPI / Swagger docs left public
- GraphQL schema introspection exposing mutations like
deleteUser - HTTP history while using an admin demo vs a normal account
Build a map of privileged verbs, then call them with a normal session.
Testing method
- Create a normal user and an admin user (or use the program’s roles).
- Capture an admin-only request.
- Replay it with the normal user’s cookies/token, same body.
- Confirm the action succeeded (resource changed) not just a 200 on a no-op.
Also try HTTP method swapping (GET vs DELETE), alternate versions (/v1 vs /v2), and hidden GraphQL mutations.
Impact examples
- Normal user triggers
POST /api/admin/users/:id/ban - Member calls
mutation { inviteAdmin(...) - Support role can change billing for any tenant function-wide
Report tips
Show role A vs role B tokens, the privileged endpoint, before/after state on accounts you own. Recommend role checks in a central authorization layer — not only in the UI.
Defensive checklist
- Enforce authorization in the service layer for every privileged function.
- Deny by default; allowlist roles per operation.
- Strip admin routes from public client bundles where possible.
- Add integration tests that attempt admin actions with member tokens.
- Disable GraphQL introspection in production.
BFLA rewards hunters who inventory functions, not just objects. If the UI hides a button but the API still serves it, you have a finding.
Original Bugflare guide informed by OWASP API Security — broken function level authorization.