Broken Object Level Authorization (BOLA / IDOR)

Critical Severity Technical Guide

Vulnerability Description

BOLA occurs when an API endpoint exposes database identifiers directly without verifying whether the requesting user has permission to access that specific object, leading to unauthorized data exposure.

Remediation Guide

To resolve this vulnerability, follow these config changes or developer practices:

Implement access control checks at the controller/model layer for every user request. Use random, non-sequential identifiers (like UUIDs) for resource handles.

Verify Your Fix

After applying the remediation, run an external attack-surface scan to verify that the vulnerability is no longer detected by WebScanify.

Is your website vulnerable?

Run a free security scan now to identify missing headers, outdated JS, and other deployment vulnerabilities.