Feature flag hides a live route
A flag that removes a route from the UI, or from a gateway rule, is not authorization if the handler is still mounted. Inventory beta, impersonation, billing, and debug routes whose flag is checked in the client or in a path rule the request can miss. If the…
Tags: authz, flag, misconfig, fail-open
Typical severity: P3-P4
What it becomes
Low alone when the handler still checks role, and it becomes broken access control when the flag is the only gate or it fails open.
Where to look
SPA route tables compared with API handlersgateway rules that key on a flagserver defaults when the flag service errors
Chains
- Broken function-level authorization: The handler runs for an account you own whose flag is off, and the flag was the only gate.
- Fail open: When the flag service times out or errors, the route defaults to enabled and the same gate disappears.
Notes
- Compare the flag on an account you own. Do not flip a global flag for every customer if the program forbids it.
- A hidden button with a working role check is inventory. Report the missing server-side decision, not the fact that a flag exists.