bfla

Here are 3 public repositories matching this topic...

kabiri-labs / overstep

Authorization testing for MCP servers; works on HTTP APIs too. Turns an access-control matrix into positive & negative tests that catch BOLA, BFLA, BOPLA, privilege escalation, token-audience and session-binding flaws across tools and resources — with CWE/OWASP-tagged SARIF for CI/CD.

mcp owasp ci-cd authorization appsec privilege-escalation sarif devsecops security-testing dast api-security idor broken-access-control bola model-context-protocol agent-security mcp-security bfla authorization-testing

Updated Aug 13, 2026
Python

m3m0o / portabilis-ieducar-user-type-privilege-escalation

Star

Proof of concept for exploitation of the vulnerability described in CVE-2025-11554, which concerns the possibility of a privilege escalation through arbitrary requests to user types change endpoint in the i-Educar software.

exploit privilege-escalation broken-access-control cve-2025-11554 bfla