Attack scenario
BOPLA – Broken Object Property Level Authorization
An API exposes or allows modification of sensitive object properties that the user should not access, including excessive data exposure and mass assignment.
Why this scenario matters
The adversary inspects API responses or schemas to identify hidden or privileged fields, then reads or submits them to expose sensitive data or change roles, account state, prices, limits, or other protected attributes.
Mitigation requires explicit allowlists for readable and writable fields, property-level authorization, minimal responses, validation schemas, and negative security tests.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Collection
- Impact
- Initial Access
Relevant ATT&CK techniques
Reference frameworks
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.