API1:2023 — Broken Object Level Authorization
Verified by Precogs Threat Research
What is Broken Object Level Authorization (BOLA)?
APIs exposing endpoints that handle object identifiers without verifying the requesting user has permission to access the specific object. Attackers substitute IDs in API calls to access other users' data.
Impact
The #1 API risk. Affects nearly every API. Enables mass data exfiltration by iterating through predictable IDs (IDOR — Insecure Direct Object Reference).
How Precogs AI Addresses API1
Precogs AI detects missing object-level authorization in API code, identifying endpoints where user identity is not verified against resource ownership.