Broken Object Level Authorization is the most common and one of the most damaging API vulnerabilities, sitting at the top of the OWASP API Security Top 10. It occurs when an API fails to verify that the user making a request is actually authorized to access the specific object (data record) they are requesting. Because APIs frequently expose endpoints that operate on objects identified by an ID, an attacker can simply change that ID to access data belonging to someone else.
A typical example: an endpoint like GET /api/accounts/12345 returns account 12345’s details. If the API only checks that the caller is logged in – but not that they own account 12345 – an attacker can change the ID to 12346, 12347, and so on, harvesting other users’ records. This manipulation of an object reference to reach unauthorized data is the essence of BOLA. It is closely related to (and often used interchangeably with) Insecure Direct Object Reference (IDOR).
BOLA is so prevalent because object-level authorization must be enforced on every request that touches a user-owned resource, and developers frequently assume that authentication alone is sufficient, or that obscure/non-sequential IDs provide safety (they do not – attackers enumerate or leak them). The flaw is a logic error rather than a malformed input, so it typically passes through firewalls, gateways, and generic scanners unnoticed, since each individual request looks perfectly valid.
The impact is direct and serious: large-scale unauthorized access to sensitive data, including PII, financial records, and confidential business information – and, depending on the endpoint, the ability to modify or delete other users’ data. Preventing BOLA requires enforcing ownership and authorization checks on the server for every object access, tying each request to the authenticated user’s entitlements, avoiding reliance on ID unpredictability as a control, and testing endpoints specifically for object-level access violations. Because exploitation requires understanding the application’s data model, dedicated business-logic-aware testing and monitoring are essential.