Rule Definition
Exploitation requires the attacker to send legitimate API calls to the API endpoint that they should not have access to. These endpoints might be exposed to anonymous users or regular, non-privileged users. It’s easier to discover these flaws in APIs since APIs are more structured, and the way to access certain functions is more predictable (e.g., replacing the HTTP method from GET to PUT, or changing the “users” string in the URL to "admins"). When defining APIs inside controllers and the methods called on by APIs to perform certain tasks it is important to restrict the user(authenticated or otherwise) based on her role.

Remediation
Review your API endpoints against function level authorization flaws, while keeping in mind the business logic of the application and groups hierarchy. Put restrictions on actions like Delete, Put after reviewing the context thoroughly.

https://github.com/OWASP/API-Security/blob/master/2019/en/src/0xa5-broken-function-level-authorization.md