Broken function level authorisation (BFLA)
In API security, broken function level authorisation is a flaw where the API checks that a caller is authenticated but not that their role is permitted to invoke that particular operation. The endpoint exists, the token is valid, and an ordinary user reaches an administrative function simply by calling it.
It is the function level twin of broken object level authorisation: BOLA is about reaching another user’s record through the same operation; this one is about reaching an operation that should not be available to you at all. It is catalogued as API5:2023 in the OWASP API Security Top 10.
The pattern behind it is almost always a check that lives in the client. The administrative button is hidden from the interface, the route is not linked anywhere, and the server assumes that is sufficient. Verb based variants are just as common: the GET on a resource is authorised properly and the DELETE on the same path is not.
Testing it is mechanical rather than clever. We build a matrix of every documented and undocumented operation against every role we hold, replay each request with each token, and record what the server returns. The findings that come out of that grid are usually the highest severity items in an API report, because they need no exploit and no unusual conditions, only a valid low privilege token. The fix is to enforce role based access control at the endpoint, deny by default, and this is part of the API testing work where this is a standing check.