API Hacking: Broken Object Level Authorization (BOLA)

BOLA is the API world's IDOR: the server trusts that if you know an object ID, you're allowed to touch it. It shows up everywhere invoices, messages, and medical records share predictable identifiers.

Clients love UUIDs because they feel safe. Authorization still has to happen server-side on every call. When it doesn't, swapping IDs becomes a quiet data breach.

Where authorization usually slips

Common patterns: nested routes that check parent access but not child objects, batch endpoints that skip per-item checks, and mobile APIs that expose extra fields on 'read' endpoints.

GraphQL resolvers and microservices multiply the problem—each service assumes another layer already validated the user.

What I test on authorized targets

Work horizontally across accounts at the same privilege level first—user A shouldn't read user B's orders. Then go vertical: can a standard user hit admin-only object IDs if they're guessable?

• Compare responses for shape and status codes, not just 200 vs 403

• Note endpoints that accept IDs in body, query, and headers

• Check export, PDF, and webhook callbacks—they often forget checks

Fixes defenders actually ship

Bind every object access to the authenticated principal in one place—policy middleware beats scattered if-statements. Log denied access attempts; they become detection signals.

For reports, show minimal cross-account proof and describe blast radius: read, write, or delete.

BOLA is boring until it isn't. It's also one of the fastest ways to prove real impact on an API assessment.

Keep testing inside program or contract scope—never point cross-account checks at strangers' production data.

Collections and bulk endpoints

List and search endpoints often filter incompletely—returning objects you shouldn't see even when single-object routes enforce checks. Pagination cursors can leak neighbors if ordering is predictable.

When reporting, mention whether IDs are enumerable and whether write operations share the same flaw as read—triage teams upgrade severity fast on editable cross-tenant data.

UUIDs and indirect references

Even opaque IDs fail when APIs accept attacker-supplied IDs in batch arrays without per-element checks.

Recommend indirect reference maps at the API gateway when multiple services expose the same object types.

Log access by object type and tenant—detection catches BOLA abuse faster than periodic pen tests alone.

---

Worth reading next

Web Hacking for Pentesters: IDOR and Broken Object Access

API Hacking: Mass Assignment and Excess Data Exposure

API Hacking: Swagger and OpenAPI Recon