Broken Function Level Authorization occurs when APIs expose sensitive functions or administrative operations without enforcing proper role-based or permission-based access checks, allowing attackers to invoke actions beyond their privileges.

Remediation

• Implement server-side role and permission validation for every API endpoint, especially administrative and sensitive functions.
• Segregate administrative and user-level functions into separate endpoints and enforce strict authentication and authorization checks.
• Avoid relying solely on client-side enforcement; ensure authorization logic is applied consistently on the server.