What Is BOLA (IDOR) Vulnerability?

BOLA, also called IDOR, is an authorization flaw that exposes records outside the requester's scope. It lets attackers reach another user's object by changing an identifier — no exploit tooling required, just a different UUID in the same request.

The vulnerability is rarely caused by missing login checks. It usually appears when code validates "who are you?" but skips "do you own this object?" on read or write paths. AI-generated APIs often miss this second check, because it's the one that only fails once a second tenant's data actually exists.

A non-technical analogy: being allowed into an apartment building does not mean you can open every unit door by changing the unit number on the intercom request.

Start free scan | See sample audit

Where BOLA Hides in a Typical Stack

• REST/API routes — GET /api/orders/:id that looks up by ID alone, with no WHERE tenant_id = session.tenantId clause.
• Next.js Server Actions — mutations that accept a projectId from form data and trust it without binding to the caller's session. See Next.js Server Action security for the full pattern.
• Supabase queries run from the client — if Row Level Security isn't enabled, every select() call is effectively a BOLA vulnerability at the database layer, regardless of what the frontend code does.
• File and asset URLs — sequential or guessable storage paths (/invoices/1043.pdf) that don't check the requester against the invoice owner.

BOLA is the most common single manifestation of broken access control — the umbrella OWASP category it belongs to. Fixing it structurally usually means moving from role-only checks to the object-level enforcement described in RBAC vs ABAC vs FGAC.

Agentic Risk (Cursor, v0, Bolt)

Ubserve Internal Audit data from 2026 shows 27.9% of AI-generated mutation routes enforce session presence but miss actor-to-object checks. This is the highest-frequency launch blocker in founder-shipped APIs.

Wrong vs. Right

// WRONG: object fetch by ID only
const order = await db.order.findUnique({ where: { id: params.id } });

// RIGHT: object fetch by ID + tenant/user scope
const order = await db.order.findFirst({
  where: { id: params.id, tenantId: session.tenantId },
});

Copy-Paste Fix Prompt for Cursor/Claude

Audit my API for BOLA/IDOR vulnerabilities.
1. Enumerate all routes accepting IDs.
2. Flag lookups not constrained by authenticated tenant/user scope.
3. Patch all reads/writes with actor-to-object ownership checks.
4. Add negative tests where UUIDs from other tenants return 404/403.
Return code diffs + test cases only.

Run a free URL scan. If it finds issues, paid plans unlock the full report, exact AI fix prompts, PDF export, and deeper audit coverage.