Attack scenario
BFLA – Broken Function Level Authorization
A regular or unauthenticated user invokes an administrative or privileged API function that should not be available to them.
Why this scenario matters
The adversary guesses an endpoint or changes the HTTP method, API version, or request role to reach a sensitive function. Impact may include user export, role changes, data deletion, control disablement, or service disruption.
Every business function requires consistent server-side authorization, deny-by-default enforcement, administrative-controller separation, role checks, and testing across all API methods and versions.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Discovery
- Initial Access
- Persistence
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.