API5:2023 Broken Function Level Authorization

Privileged endpoints (admin panels, billing controls, user management) are reachable by lower-privilege roles. It is the function-level twin of BOLA: any signed-in user can run admin actions.

What Vulkro detects

Admin-pattern URLs and handler names with no role assertion in the pipeline. A role check is recognised from middleware imports, dependency declarations, or decorators that reference known guard names.

Non-compliant code

// NestJS: admin route, no role guard
@Controller('admin')
export class AdminController {
  @Delete('users/:id')
  async deleteUser(@Param('id') id: string) {
    return this.users.deleteById(id);  // any authenticated caller reaches this
  }
}

Compliant code

// NestJS: admin-only guard on the controller
@UseGuards(JwtAuthGuard, AdminGuard)
@Controller('admin')
export class AdminController {
  @Delete('users/:id')
  async deleteUser(@Param('id') id: string) {
    return this.users.deleteById(id);
  }
}

References

• CWE-285
• CWE-863
• OWASP API5:2023

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.