Security Test: Broken Object Level Authorization¶

Description¶

Default Severity: medium

Broken Object Level Authorization happens when an app lets users access objects by simply changing an identifier like a number or key without checking if they should really see that object. This might let an attacker look at or modify someone else’s data. Developers often assume that passing an object reference is safe, and that weak security controls don’t need to check if the requester owns that data. The danger is that if such basic checks are missing, critical information can be exposed or altered, leading to potential breaches or loss of trust in the application.

Configuration¶

Identifier: access_control/bola

Examples¶

All configuration available:

checks:
  access_control/bola:
    skip: false # default
    options:
      threshold_enum: 0.6 # default
      threshold_res: 0.8 # default

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶