What Is BOLA (IDOR) Vulnerability?

BOLA, also called IDOR, is an authorization flaw that exposes records outside the requester’s scope. It lets attackers reach another user’s object by changing an identifier.

The vulnerability is rarely caused by missing login checks. It usually appears when code validates "who are you?" but skips "do you own this object?" on read or write paths. AI-generated APIs often miss this second check.

A non-technical analogy: being allowed into an apartment building does not mean you can open every unit door by changing the unit number on the intercom request.

01. [Component: DarkWireframeKey]

As shown in the Policy Gate diagram, the left lane should represent authenticated actor identity, and the right lane should represent object-level ownership enforcement per request.

Start free scan | See sample audit

02. Agentic Risk (Cursor, v0, Bolt)

Ubserve Internal Audit data from 2026 shows 27.9% of AI-generated mutation routes enforce session presence but miss actor-to-object checks. This is the highest-frequency launch blocker in founder-shipped APIs.

03. Wrong vs. Right

// WRONG: object fetch by ID only
const order = await db.order.findUnique({ where: { id: params.id } });

// RIGHT: object fetch by ID + tenant/user scope
const order = await db.order.findFirst({
  where: { id: params.id, tenantId: session.tenantId },
});

04. Copy-Paste Fix Prompt for Cursor/Claude

Audit my API for BOLA/IDOR vulnerabilities.
1) Enumerate all routes accepting IDs.
2) Flag lookups not constrained by authenticated tenant/user scope.
3) Patch all reads/writes with actor-to-object ownership checks.
4) Add negative tests where UUIDs from other tenants return 404/403.
Return code diffs + test cases only.