Which vulnerability arises when privileged functions are accessible without proper authorization checks, such as changing user roles by non-privileged users?

Which vulnerability arises when privileged functions are accessible without proper authorization checks, such as changing user roles by non-privileged users?

• A. Broken Access Control
• B. Missing Function Level Access Control
• C. Access Control
• D. Password Exploitation

Answer: (B)

When a system lets privileged operations run without verifying who is calling them, it fails at function-level authorization. Changing a user’s role is a sensitive action that should only be allowed for administrators; if a non-privileged user can invoke that capability, the system is not properly enforcing authorization at the function level. This exact situation is described as Missing Function Level Access Control. While Broken Access Control is a broader umbrella term for various access-control failures, this scenario is a precise instance of missing function level checks. The other options are too generic or unrelated: Access Control by itself doesn’t specify the per-function checks, and Password Exploitation concerns credential-based attacks rather than bypassing authorization on privileged functions. To fix, ensure explicit authorization checks for every privileged function, enforce least privilege, and log and test for privilege escalation paths.

When a system lets privileged operations run without verifying who is calling them, it fails at function-level authorization. Changing a user’s role is a sensitive action that should only be allowed for administrators; if a non-privileged user can invoke that capability, the system is not properly enforcing authorization at the function level. This exact situation is described as Missing Function Level Access Control. While Broken Access Control is a broader umbrella term for various access-control failures, this scenario is a precise instance of missing function level checks. The other options are too generic or unrelated: Access Control by itself doesn’t specify the per-function checks, and Password Exploitation concerns credential-based attacks rather than bypassing authorization on privileged functions. To fix, ensure explicit authorization checks for every privileged function, enforce least privilege, and log and test for privilege escalation paths.