---
title: P&P Secure Emphasizes Detailed Permission Control System as an Alternative to API Security Vulnerabilities
url: https://www.dataloco.com/en/pp-secure-emphasizes-detailed-permission-control-system-as-an-alternative-to-api-security-vulnerabilities
published: 2026-11-07T20:20:31+00:00
language: en
section: Security
source: https://www.dailysecu.com/news/articleView.html?idxno=209321
publisher: Dataloco
---

# P&P Secure Emphasizes Detailed Permission Control System as an Alternative to API Security Vulnerabilities

P&P Secure has highlighted the need for a meticulous permission control system in light of recent incidents involving personal information leaks through APIs (Application Programming Interfaces). Experts suggest that a comprehensive review of data access rights and processing procedures is necessary due to these incidents.

Reports indicate that some cases involved merely verifying login status without validating actual access rights to the data. Furthermore, unnecessary personal information was found in API response values. Even when security measures were applied to the latest APIs, older versions of APIs lacking proper security management posed unauthorized access risks.

APIs serve as data conduits connecting web and mobile applications with cloud environments. Just because a request specification is correct or initial login authentication has been completed does not guarantee access rights to the data. It is essential to verify the authorization scope based on the calling entity, the limit of data that can be queried, and whether there are mass or repeated calls. The Personal Information Protection Commission has recommended measures such as minimum privilege allocation, blocking mass calls, excluding unnecessary response values, and organizing unused APIs to prevent API-based leaks.

P&P Secure asserts that not only APIs but also access rights and actual work activities in web-based work environments must be managed together. They emphasized the necessity of a control system that identifies users accessing internal work systems and cloud management consoles, allowing for specific tracking of actions performed post-access.

## This story in other languages

- [Français](https://www.dataloco.com/fr/ppc-secure-met-laccent-sur-un-systeme-de-controle-dacces-detaille-pour-la-securite-des-api)
- [Português (Brasil)](https://www.dataloco.com/pt-br/pp-secure-enfatiza-sistema-de-controle-de-acesso-em-resposta-a-falhas-de-seguranca-em-apis)