Attack scenario
BOLA – Broken Object Level Authorization
An adversary changes an object identifier in an API request and gains access to data or operations belonging to another user, account, or tenant.
Why this scenario matters
BOLA occurs when an API authenticates the user but does not verify authorization for the specific record on every object operation. Manipulating an ID in the URL, parameter, header, request body, or GraphQL variable may enable reading, changing, or deleting another party's data.
Server-side authorization must be enforced for every object and operation. Unpredictable UUIDs, authentication alone, or comparison of a single user ID do not replace centralized authorization, deny-by-default rules, testing, and anomaly detection.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Initial Access
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.