🛎️ BFLA: When 'Admin Only' Just Means 'Admin Usually'
BOLA gets all the OWASP fame for letting you peek at someone else's data. Its quieter sibling, Broken Function Level Authorization, is the one that lets a regular user call an admin endpoint directly and quietly promote themselves. Same root cause, much scarier blast radius.
