🧪 Labs › Access Control
Broken Function-Level Authorization (BFLA)
Severity: High
A privileged action that only the UI hides — call it directly and it runs.
What it is
BFLA is reaching a function you shouldn't: an admin-only operation whose endpoint is protected only by the fact that the normal UI doesn't show it to you.
The method and the path are the gate attackers notice — swapping GET for POST/PUT/DELETE, or calling /api/admin/* directly, often reveals actions with no server-side role check.
Impact is action, not just data: delete records, promote accounts, change other users' settings.
How to approach it
- Enumerate endpoints and methods beyond what the UI uses — admin paths, verbs the client never sends.
- As a low-privilege user, call a privileged action directly and see whether it's refused.
- Try method swaps on the same path; sometimes only one verb is guarded.
- Compare what a privileged account can do with what the server actually enforces.
Your task
Perform an administrative action through the API as an ordinary user.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Deny by default and check the caller's role on every function, server-side.
- Don't treat hidden UI or an unusual method as a security boundary.
- Centralise authorization so a new endpoint inherits the checks.
More Access Control labs
- Insecure Direct Object References (IDOR) — The app checks the number on the door, not whether the door is yours.
- Broken Object-Level Authorization (BOLA) — An API hands you any record by id — without checking it's yours. IDOR for APIs.