Skip to content © 2026 Jer Catallo. Reference material only, always confirm against the official source.
Broken Object Property Level Authorization incident response playbook · Cybersecurity Atlas
Home Playbook Broken Object Property Level Authorization
Broken Object Property Level Authorization API Security API3:2023 – Broken Object Property Level Authorization
An API exposes or accepts object properties that the caller should not be able to read or modify, combining excessive data exposure and mass-assignment risks.
1 Block writes to affected endpoints or strip protected fields at the API boundary. 2 Review recent changes to ownership, role, financial, and workflow properties. 3 Remove sensitive fields from responses and rotate any secrets that were exposed. 1
Use explicit input DTOs and allowlists for writable properties per operation.
2 Authorize sensitive property reads and writes separately from object access.
3 Return explicit response projections instead of serializing persistence entities. 1 Test hidden, read-only, and privileged properties in automated API security tests. 2 Detect contract drift and fail builds when undocumented fields become reachable. 3 Document field-level authorization rules alongside the API schema. Adding privileged fields such as role, ownerId, status, or creditLimit to update requests Requesting undocumented fields through GraphQL or sparse field selectors Binding request bodies directly to persistence models Returning full internal objects instead of response-specific projections Sensitive internal fields appearing in API responses Updates to protected properties without a corresponding privileged action Requests containing undocumented or normally server-managed attributes Schema drift between public API contracts and serialized database models Burp Suite OWASP ZAP Schemathesis OpenAPI Diff
