E-commerce. Healthcare. Banking. Fitness. Dating. Delivery. Documents. Smart homes. HR systems.
Nine completely different industries. Nine completely different types of data. One identical failure.
The API checked authentication — "Are you logged in?" — but skipped authorization — "Are you allowed to access this specific object?"
Authentication = proving who you are. A valid login, a valid token. "Yes, I know you."
Authorization = proving what you're allowed to do. "Yes, I know you — and this specific record belongs to you."
BOLA is always, always, always an authorization failure. The API knew who the user was. It just never asked if the user was allowed to have what they asked for.