Access Control: Broken Object Level Authorization¶

Identifier: bola_idor

Scanner(s) Support¶

Description¶

Broken Object Level Authorization (IDOR) occurs when an application allows callers to access objects or resources by manipulating identifiers or paths without verifying that the caller is authorized for the specific object. This can expose user records, administrative endpoints, or other sensitive resources to unauthorized callers.

How we test: We replay requests against object-referencing endpoints and common access-control paths, comparing responses across callers. When a caller receives successful responses with distinct resource bodies for paths that should be restricted, we report broken object-level authorization.

Prerequisites:

• The scan must include authenticated traffic with readable object identifiers.
• Deeper IDOR analysis requires at least two configured users and enough application activity to compare access across accounts.

References:

• OWASP API Security Top 10: Broken Object Level Authorization
• OWASP WSTG: Testing for Insecure Direct Object References
• MITRE CWE-863: Incorrect Authorization
• MITRE CWE-639: Authorization Bypass Through User-Controlled Key

Configuration¶

Example¶

Example configuration:

---
security_tests:
  bola_idor:
    do_not_fuzz: []
    skip: false

Reference¶

do_not_fuzz¶

Type : List[string]*

List of arguments to not fuzz for this security test.

skip¶

Type : boolean

Skip the test if true.