Broken Object Level Authorization (BOLA)

Overview

Broken Object Level Authorization occurs when an API accepts a user-controlled object identifier but fails to verify that the authenticated requester may access that specific object. Targets can include accounts, invoices, wallets, documents, transactions, or administrative records.

An attacker may replace an identifier in a path, query, or request body and receive another user’s data or perform unauthorized changes. Random-looking identifiers reduce guessing but do not replace server-side authorization because identifiers can leak through logs, links, or other responses.

Every function that reads or changes an object should enforce ownership or policy checks using trusted server-side context. Tests should compare access across users, roles, and tenants, while monitoring looks for sequential probing, repeated denials, and unusual cross-account access.

For Broken Object Level Authorization (BOLA), teams should measure unnecessary friction, exclusion, delay, privacy intrusion, failed recovery, and inconsistent treatment while preserving the safeguards needed for material payment and commerce exposure.

BOLA is an API vulnerability where changing an object identifier lets a user access or modify another user’s protected resource. BOLA is prevented by checking permission on every requested object, not by hiding or randomizing object identifiers.

For Broken Object Level Authorization (BOLA), the trust decision should establish BOLA is an API vulnerability where changing an object identifier lets a user access or modify another user’s protected resource and bind the result to the requested action and protected resource. Teams should test issuance, storage, validation, expiry, revocation, recovery, and privileged override for permissions and protected actions, rather than checking only a successful request. Logs concerning the Broken Object Level permission decision and permissions and protected actions should support investigation without exposing reusable secrets or unnecessary personal data.