BOLA (Broken Object Level Authorization), also known as IDOR (Insecure Direct Object Reference), is ranked #1 in the OWASP API Security Top 10. It is the most prevalent and impactful API vulnerability found in real-world assessments.
Look for numeric or predictable IDs in URL paths, query parameters, or request bodies. Test by substituting your own ID with another user's ID.
🚨 BOLA is responsible for massive data breaches. In 2019, a major Australian health provider exposed 3.1 million patient records via a BOLA flaw in their API.
Verify exercises to earn ★ 180 XP and unlock next lab level.