Object-level access control (BOLA / IDOR) is the failure to verify that the authenticated subject may access this specific resource. The server accepts a reference (ID, UUID, slug) but does not enforce ownership, tenancy, or role on that instance.

Pages#

• Direct reference tampering (IDOR)
• Batch object operation
• Alternate key lookup
• Nested object without ownership check
• Predictable encoded IDs
• Public identifier guessing
• Relationship trust mischeck