Broken Object Level Authorization (BOLA) is an API vulnerability where the application fails to verify that the requesting user has permission to access or modify a specific object, allowing attackers to access other users' data by manipulating object identifiers.
APIs often expose endpoints that accept object IDs as parameters. If the API doesn't verify that the authenticated user owns or has permission to access the referenced object, attackers can enumerate IDs to access unauthorized resources.
# User requests their own order
GET /api/orders/1001
Authorization: Bearer user_token
# Response contains user's order
{"id": 1001, "user_id": 42, "total": 99.99, "items": [...]}
# Attacker changes order ID
GET /api/orders/1002
Authorization: Bearer user_token
# API returns another user's order (BOLA vulnerability!)
{"id": 1002, "user_id": 43, "total": 500.00, "items": [...]}