Broken Object Level Authorization

Broken Object Level Authorization (BOLA) allows attackers to manipulate object identifiers in API requests to gain unauthorized access to data belonging to other users.

Remediation

Enforce server-side authorization checks for every object access request based on the authenticated user’s permissions.
Validate object identifiers against the authenticated session context before processing.
Avoid exposing predictable or sequential object IDs; use UUIDs or opaque references.

Metadata

Severity: high
Slug: broken-object-level-authorization

CWEs

639: Authorization Bypass Through User-Controlled Key
284: Improper Access Control
285: Improper Authorization

OWASP

A01:2021: Broken Access Control
API1:2023: Broken Object Level Authorization

Available Labs

Open Openapi labs in SecDim Play for this vulnerability.

easy

BOLA.api

Other Easy OpenAPI New Signature

easy

Mass Assignment.api

Other Easy OpenAPI Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.