A vulnerability where privileged functions are accessible without proper authorization checks is known as:

A vulnerability where privileged functions are accessible without proper authorization checks is known as:

• A. Missing Function Level Access Control
• B. Broken Authentication
• C. Timeout Exploitation
• D. XML External Entity Attack

Answer: (A)

The key idea here is enforcing authorization for every function call or privileged operation. When an application exposes actions that only admins should perform, those checks must be applied at every entry point. If privileged functions are accessible without verifying that the caller has the right rights, a user who should not have those capabilities can still invoke them. This is known as Missing Function Level Access Control. In practice, you might see this when an ordinary user can call an admin-only endpoint or trigger a sensitive operation by manipulating a URL or API parameter, and the backend fails to confirm the user’s authorization before executing the action. The correct answer identifies this specific flaw: the system neglects to enforce access control for privileged functions. The other options describe different issues: Broken Authentication involves weaknesses in reliably proving who a user is (not about whether their rights to perform a function are checked after login); Timeout Exploitation is not a standard vulnerability type related to access control; XML External Entity Attack targets how XML is parsed and processed, not whether privileged functions are protected.

The key idea here is enforcing authorization for every function call or privileged operation. When an application exposes actions that only admins should perform, those checks must be applied at every entry point. If privileged functions are accessible without verifying that the caller has the right rights, a user who should not have those capabilities can still invoke them. This is known as Missing Function Level Access Control.

In practice, you might see this when an ordinary user can call an admin-only endpoint or trigger a sensitive operation by manipulating a URL or API parameter, and the backend fails to confirm the user’s authorization before executing the action. The correct answer identifies this specific flaw: the system neglects to enforce access control for privileged functions.

The other options describe different issues: Broken Authentication involves weaknesses in reliably proving who a user is (not about whether their rights to perform a function are checked after login); Timeout Exploitation is not a standard vulnerability type related to access control; XML External Entity Attack targets how XML is parsed and processed, not whether privileged functions are protected.