Broken Object Level Authorization (BOLA) occurs when an application exposes an endpoint that accepts an object identifier but fails to verify that the authenticated caller is actually permitted to act on that specific object. It is consistently ranked as the most impactful class of API vulnerability because it is both easy to introduce and easy to exploit.
Why it happens
APIs frequently trust the object reference supplied by the client, a numeric
id, a UUID, or a slug, and load the corresponding record without an
ownership or role check. Authentication answers who are you; authorization
must additionally answer are you allowed to touch this object. BOLA is the gap
between those two questions.
How to reason about it
For every endpoint that reads or mutates a resource, ask a simple question: if an attacker substitutes another user’s object identifier, what stops the server from returning or modifying it? If the only control is that the identifier is hard to guess, that is not authorization, it is obscurity.
The remainder of this cluster covers IDOR vs BOLA, practical testing workflows, and server-side remediation patterns.