Applications

BOLA: Broken Object Level Authorization

An API returns or modifies objects belonging to another user or tenant because authorization is not enforced per object.

RedMaw ResearchMay 12, 20266 min read

Definition

Broken object level authorization is a flaw where an authenticated request can reference an object identifier it does not own, and the application returns or modifies that object without verifying ownership or tenancy.

How the attack works

01The attacker authenticates as an ordinary, legitimate user
02They observe object identifiers used by the API
03They substitute identifiers belonging to other users or tenants
04The API responds without an ownership check
05The pattern is repeated to enumerate records at scale

How adversarial validation works

RedMaw operates two authorized identities in separate tenancy contexts and attempts cross-context object access, recording exactly which endpoints returned data belonging to the other context.

How RedMaw validates this attack

Validation runs only inside authorized scope, with agreed exploitation limits.

01Establish two authorized identities in distinct contexts
02Map object identifiers exposed by the API
03Attempt cross-context read and write access
04Record the endpoints and objects reached as evidence

Keep going

Capabilities

Application SecurityAdversarial testing of the web applications and APIs you own and authorize, aimed at proving exploitability rather than reporting resemblance to a known pattern.

Use cases

Continuous pentesting

Attackers don't see findings. They see paths.

A severity score describes a weakness in isolation. An adversary is interested in the third hop, not the first.

June 18, 2026· 6 min read

Stop assuming you are secure. Prove it.

Continuously test what an attacker can actually reach across your applications, SaaS identities, internal infrastructure and AI systems.

Request a demo Explore the platform