How do we prevent this?

Here’s how broken function level authorization is prevented: First, identify all of the functions in your application and classify them into three categories: admin (e.g., adding new users), user (e.g., updating profile info) and system (e.g., sending emails). Then create an access control list for each category by listing which users or roles have permission to perform these actions
https://t.co/vw8KYqA5Jw