A7: Missing Function Level Access Control · 2013

Sensitive functions or endpoints remain available to identities without the required role because controls exist only in the interface or are incomplete.

Summary

Sensitive functions or endpoints remain available to identities without the required role because controls exist only in the interface or are incomplete.

How the attack works

The interface hides an administrative function, but the endpoint does not check roles and accepts ordinary users.

Example

Vulnerable · Pseudocode

POST /admin/reports/export
Cookie: session=reader
return export_all_reports()

Fix: Check the authorized role on the server before executing every function.

Prevention

Enforce server-side access control for every function.
Deny by default and reuse a central authorization policy.
Test endpoints directly without relying on visible navigation.

Lineage

2013 · A4: Insecure Direct Object References Merged into Broken Access Control
2013 · A7: Missing Function Level Access Control Merged into Broken Access Control
2017 · A5: Broken Access Control Moves up to rank 1 in 2021
2021 · A01: Broken Access Control Moves up from A5:2017
2021 · A10: Server-Side Request Forgery (SSRF) New in 2021
2025 · A01: Broken Access Control Consolidates SSRF and remains at rank 1

2013:A4 → 2017:A5: IDOR is integrated into Broken Access Control.
2013:A7 → 2017:A5: Missing Function Level Access Control is integrated into Broken Access Control.
2017:A5 → 2021:A01: Broken Access Control moves up from rank 5 to 1.
2021:A01 → 2025:A01: Broken Access Control remains at rank 1.
2021:A10 → 2025:A01: SSRF is consolidated into Broken Access Control.

Sources

Open official source ↗

Buy me a coffee