BFLA stands for Broken Function Level Authorization. It happens when an application lets a user call a function, endpoint, or action that should be restricted to a different role or identity. The check may exist for login, but not for the specific operation, so a low-privilege user can trigger admin-only behavior such as deleting records, changing permissions, or reaching internal actions through an API.
BFLA matters because it turns ordinary requests into privilege escalation. Attackers often look for hidden or undocumented endpoints, then replay requests with a normal account to see whether the server enforces authorization on every function. Defenders test for BFLA by comparing responses across roles, verifying server-side access control on each action, and mapping endpoints to business permissions rather than only to authentication status. It is a common API security failure because the interface may look valid while the authorization logic is incomplete.