Broken Object Level Authorization (BOLA/IDOR)
BOLA occurs when an API endpoint allows access to objects by modifying identifiers in the request without proper authorization checks. Attackers can enumerate IDs to access other users' data.
Overview
Broken Object Level Authorization (BOLA), also known as Insecure Direct Object Reference (IDOR), is the #1 API security risk. It occurs when an API uses user-supplied identifiers (IDs) to access objects but fails to verify that the requesting user is authorized to access the specific object. Attackers simply modify the ID parameter in API calls to access other users' data.
Types & Variants
Horizontal BOLA
Accessing objects owned by other users at the same privilege level.
Vertical BOLA
Accessing objects that require higher privilege levels.
Impact
Unauthorized data access, horizontal and vertical privilege escalation, complete data breach of other users' records.
Examples
IDOR via API
GET /api/users/1001/orders => GET /api/users/1002/orders (accessing another user's orders)
Remediation
Implement object-level authorization checks on every endpoint, use random non-sequential IDs, validate user ownership before returning data, and implement comprehensive access control logging.
Implement authorization checks on every object access
Use random, non-sequential object identifiers (UUIDs)
Validate that the requesting user owns the requested resource
Log all authorization failures for monitoring
Implement automated BOLA testing in CI/CD pipelines
Related SuperClue scanner checks
These scanner checks look for signs of Broken Object Level Authorization (BOLA/IDOR). What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works