Skip to content © 2026 Jer Catallo. Reference material only, always confirm against the official source.
Broken Object Level Authorization (BOLA) incident response playbook · Cybersecurity Atlas
Home Playbook Broken Object Level Authorization (BOLA)
Broken Object Level Authorization (BOLA) API Security API1:2023 – Broken Object Level Authorization
An API accepts a user-controlled object identifier but does not verify that the authenticated caller is authorized to access that specific object, enabling cross-account data access or modification.
1 Disable or restrict affected object endpoints while ownership checks are added. 2 Identify exposed object types and review access logs for cross-account activity. 3 Revoke sessions involved in confirmed abuse and notify affected data owners. 1
Enforce authorization against the requested object on every read and write.
2 Derive tenant and owner scope from trusted identity context rather than request data.
3 Add negative tests that attempt access with another user's valid identifier. 1 Centralize object authorization policy and deny access by default. 2 Add authorization matrices and BOLA cases to API threat models and test suites. 3 Alert on cross-tenant access anomalies and high-cardinality ID enumeration. Changing record IDs in REST paths, query strings, or request bodies Enumerating predictable identifiers across tenants or customer accounts Reusing a valid token to access objects owned by another user Calling nested resource endpoints that omit parent-child authorization checks One principal requesting sequential or high volumes of unrelated object IDs Successful access to resources whose owner or tenant differs from the caller Authorization decisions logged only at the endpoint or role level Repeated 403 or 404 responses followed by access to a nearby identifier Burp Suite OWASP ZAP Schemathesis 42Crunch
