API1:2023 — Broken Object Level Authorization

Slide 12 · Vertical BOLA

Lower role. Higher-privilege data.

You're a regular user. But the admin data has no lock on it.

Step by step

Step 1. You sign up as a regular user. You can see your own account data.

Step 2. You explore the API — maybe by watching network requests or reading the app's documentation. You notice an endpoint: /api/reports/revenue/monthly

Step 3. You send a request to that endpoint using your regular user token.

Step 4. The API returns the company's monthly revenue data. It checked that you were logged in — but not that you were an admin.

// Regular user token GET /api/reports/revenue/monthly Authorization: Bearer regular-user-token // Server checks: is the token valid? ✓ // Server checks: is this user an admin? ✗ (never asked) // Response: full revenue report returned

Why vertical hits harder

Admin-level data is more sensitive by design. Revenue figures, all user records, internal metrics, audit logs. Vertical BOLA turns a regular account into an intelligence goldmine. A competitor, a journalist, or a criminal with a free account can access data that should only exist for executives.

Same root cause as horizontal

The API checked authentication (valid token) but skipped authorization (is this token allowed to access this specific object?). The object just happens to be an admin-level resource this time.

← Back Show me a real vertical example →