API1:2023 — Broken Object Level Authorization

Slide 9 · Two Types

BOLA comes in two flavors.

Same root cause, different direction of attack.

Horizontal BOLA

Same privilege level, different user

You're a regular user accessing another regular user's data

Example: seeing someone else's order, profile, or medical record

Most common type — the Peloton and USPS breaches were this

Vertical BOLA

Lower privilege accessing higher privilege objects

You're a regular user accessing admin-level data

Example: reading revenue reports, accessing all users' records

Less common but higher impact — admin data is more sensitive

The analogy

Horizontal = you're in apartment 4B. You try 4A's key. It opens. Same floor, neighbor's door.

Vertical = you're a tenant. You try the building manager's key. It opens. Different floor, different authority entirely.

Why both happen

In both cases the API made the same mistake — it didn't check ownership or role when an ID was supplied. The only difference is whose data ended up exposed.

← Back Show me horizontal BOLA →