Unrestricted Access to Sensitive Business Flows occurs when APIs expose high-value operations (e.g., financial transactions, account changes, inventory manipulation) without sufficient anti-automation or abuse-prevention controls, enabling attackers to exploit these workflows at scale.

Remediation

• Implement strict server-side authorization and contextual checks (e.g., transaction limits, geolocation validation) for sensitive workflows.
• Apply rate limiting and anomaly detection on endpoints performing critical business operations.
• Introduce step-up authentication (e.g., MFA) for high-risk actions to prevent automated or unauthorized execution.

Metadata

• Severity: high
• Slug: unrestricted-access-to-sensitive-business-flows

CWEs

• 770: Allocation of Resources Without Limits or Throttling
• 307: Improper Restriction of Excessive Authentication Attempts
• 285: Improper Authorization

OWASP

• API6:2023: Unrestricted Access to Sensitive Business Flows