Slide 8 · Why It's #3
It's everywhere. And it's invisible from the outside.
The risk is in the data model, not the access control list.
The Scope Problem
BOPLA affects every API endpoint that creates, reads, updates, or deletes data — which is most of them. The vulnerability isn't in who can call the endpoint; it's in which fields are exposed or accepted within that call.
A well-designed authorization system that correctly checks object ownership (no BOLA) can still be completely vulnerable to BOPLA if it doesn't also check property-level access within each object.
No suspicious traffic — same endpoints, same users
Excessive data exposure looks like a normal API response
Mass assignment looks like a normal update request
Authorization logs show the correct user — just the wrong fields
Framework defaults favor convenience over security
New properties added to the model are automatically exposed
"We'll filter it in the frontend" is a common and wrong assumption
No obvious error when it works — the attacker's request succeeds silently