Author: Kateryna Ivanenko, Invicti Brand Manager
In today’s API-driven world, one of the most dangerous and common vulnerabilities is Broken Object Level Authorization (BOLA)—consistently ranked at the top of the OWASP API Security Top 10. If left unaddressed, BOLA can allow attackers to access, modify, or delete sensitive data belonging to other users. This article explains what it is, how it works, and, most importantly, how to prevent it.
What Is Broken Object Level Authorization?
BOLA occurs when an application fails to properly verify whether a user is authorized to access a specific object—such as a file, database record, or account—identified by a user-controllable input (e.g. ID).
In simpler terms, it means that if an attacker knows or guesses the identifier of an object they don’t own, and the system doesn’t enforce proper authorization checks, they can access or manipulate that object.
Why Is BOLA So Dangerous?
- Ease of exploitation: BOLA attacks require minimal skill—often just changing an ID in the URL or API request.
- Data leakage: Unauthorized access can expose sensitive personal or business data.
- Reputation damage: Such breaches can quickly erode customer trust.
- Compliance violation: The attack can lead to regulatory penalties.
How to Prevent BOLA Vulnerabilities
1. Implementing a strong authorization mechanism which ensures that only users with the appropriate permissions can access or manipulate specific resources.
It should be:
- Role-based or attribute-based: Permissions have to be assigned based on user roles (for example, admin) or attributes (like department, region).
- Context-aware: Considering not just who the user is, but what they are trying to access and under what conditions.
- Centralized: Using a centralized access control system to ensure consistency and ease of auditing.
- Hierarchical-aware: For organizations with multi-level structures.
2. The backend must verify whether the requesting user is authorized to access or modify a specific resource every time a user-supplied identifier is used to fetch data or perform an operation.
Best practices:
- Not trusting client input: Never assuming that if a user sends a valid ID, they are allowed to access it.
- Always validating ownership or access rights: For every API endpoint that involves object references, ensuring a backend check is performed (e.g., “Does this user own this object?” or “Does this user have read permission for this object?”).
- Not relying on frontend filters: Authorization checks must happen on the server, not on the client side.
3. Using random and hard-to-guess identifiers for records.
4. Conducting regular security testing (e.g. DAST) that includes checks for object-level authorization.
For example, the Invicti platform, which combines Netsparker and Acunetix, has additional scan configurations for authentication by different users, which helps to detect more BOLA vulnerabilities.
To test the platform for free and receive the OWASP Top 10 API Security report from Invicti, contact us in a way convenient for you.
Conclusion
Broken Object Level Authorization can be a huge threat, even the most well-designed applications. As APIs grow more complex and data more interconnected, failing to implement robust object-level access control can open the door to catastrophic breaches, against which companies should protect themselves.
