False positive : Missing function level access control (cs/web/missing-function-level-access-control) #14478

Given an abstract base controller class with an [Authorize] attribute on the class, a missing function level access control should not be reported on inheriting controller classes as the attribute is inherited on the class level.

"Made up" example illustrating the issue we have on our live code base.

    [Route("[controller]")]
    [Authorize]
    public abstract class BaseApiController<T> : ControllerBase
    {
    }

    public class WeatherController : BaseApiController<Weather>
    { 
        [HttpDelete("{id}")]
        public async Task<IActionResult> DeleteWeather([FromRoute] Guid id, CancellationToken cancellationToken)
        {
            return  await this.DeleteWeatherInDb(id, cancellationToken);
        }
    }

Having a quick look at the query code, it seems like it may indeed be looking at overridden method declarations but ignoring class level declarations when detecting if the attribute is present.
Seems like it might be a small fix.