BFLA COCO Annotator in DELETE /api/undo/ Summary An attacker can delete categories created by other users via a DELETE request to the /api/undo/ endpoint without any ownership or permission checks. This constitutes a Broken Function Level Authorization (BFLA) vulnerability, allowing unauthorized manipulation of protected resources. Vulnerable Endpoint Endpoint: /api/undo/ Parameter: ?id= PoC 1. Create a new category with admin privileges: (Screenshot of creating a category with admin user) 2. Delete the category with another user: - Request to view category ID 200 by a normal user fails. - The application accepts the request to delete category ID 200 without verifying the user's permission. 3. Exploit to delete categories for all users: - Categories 1 to 200 deleted successfully. - Normal user can delete all categories in the application. Impact Any authenticated user can delete categories created by other users. No verification is done to ensure that the requester is the original creator or has elevated permissions (e.g., admin). Leads to data integrity issues, potential denial of service, or abuse in multi-tenant environments. References OWASP API Security Top 10 – BFLA CWE-285: Improper Authorization