Typical severity: High. Likelihood of attack: High. An adversary identifies a Rest HTTP (Get, Put, Delete) style permission method allowing them to perform various malicious actions upon server data due to lack of access control mechanisms implemented within the application service accepting HTTP messages.
Design: Enforce principle of least privilege | Implementation: Ensure that HTTP Get methods only retrieve state and do not alter state on the server side | Implementation: Ensure that HTTP methods have proper ACLs based on what the functionality they expose