Broken Function Level Authorization (BFLA) 2 API-6: Unrestricted Access to Sensitive Business Flows Dec 20, 2025 API-5: Broken Function Level Authorization (BFLA) Dec 19, 2025