Endpoint-level

Authorization flaws where an HTTP route, RPC method, or internal function is callable without the correct role, scope, or tenant check.

1분 분량2026년 10월 6일 업데이트

기여자 1명

Function-level (endpoint) authorization governs which operations a caller may use: admin APIs, internal tools exposed over HTTP, debug routes, and GraphQL fields or resolvers. The application may authenticate the user and still be wrong if authorization for the action is missing, inconsistent, or only enforced on the client.

Pages#

Missing role check
GraphQL introspection
Swagger UI and OpenAPI surface
HTTP method override bypass
Debug endpoint exposure
Admin panels
Test resources in production
Hidden admin function