Home / Knowledge hub / BFLA
Knowledge hub
BFLA
An API lets an ordinary account call functions meant only for admins.
What it means
BFLA stands for Broken Function Level Authorization. It is the API flaw where an ordinary account can call a function that should be limited to admins or another privileged group. The API checks that the caller is signed in, but not that the caller's role may use that function. The caller simply asks, and the API agrees.
It is number five on the OWASP API Security Top 10 for 2023. Where BOLA is about which record you can reach, BFLA is about which action you may perform: deleting users, changing roles, exporting data or approving payments.
Why it matters
APIs expose a function for everything the app can do, and the number of functions grows quickly. Staff-only ones often sit next to normal ones, with similar paths and the same authentication. One missing role check lets a free-tier account perform paid or admin actions.
The harm is usually bigger than a single record. Calling an admin function can create privileged users, change other people's settings or remove audit data. It leads straight to vertical privilege escalation. Reviews of role checks should therefore cover each function, not only each screen.
How it shows up
It turns up where API paths and methods follow a pattern. A tester sees GET /api/users/me and tries GET /api/users, then DELETE /api/users/42. They also switch methods, try the /admin version of a path and call routes found in the mobile app or API documentation.
The fix is a central rule, applied by default to every route and method, that names which roles may call it. A route with no rule should be denied. Do not rely on hiding functions from the client or on guessing that paths are secret. Test each function as a lower role, and with no session.
Questions people ask
BFLA, answered
What is the difference between BOLA and BFLA?
BOLA is about objects: reaching a record that is not yours. BFLA is about functions: calling an action your role does not allow. A single API can have one, the other or both.
Is BFLA the same as privilege escalation?
It is a common cause of it. BFLA is the missing check. Privilege escalation is what the attacker gains from it, such as admin rights.
Why do HTTP methods matter?
Teams often protect the method they thought of, such as GET, and forget PUT, PATCH or DELETE on the same path. Test each one.
Does API documentation make BFLA more likely?
It makes admin functions easier to find, which is fine if each is protected. It becomes a problem only when the check is missing. Hiding the documentation does not fix a missing check.
How do we test an API for BFLA?
Collect every route and method from your code, specification and traffic, then call them as an ordinary account and with no session. Anything that succeeds and should not is a finding.
Sources
Where this comes from
Related
Terms that sit next to this one
BOLA
An API returns a record just because you asked for it by number.
Missing function-level access control
A sensitive action that checks you are signed in but not whether you may use it.
Privilege escalation
Gaining rights you were never given, sideways or upwards.
Broken function-level authorisation
Calling an API function your account was never meant to use.
API penetration testing
A pentest aimed at your API's endpoints, auth, data access and business rules.
Which functions does a basic account reach?
We call your API's functions as lower-level accounts and report only what actually worked, with the request, the response and the line of code. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.