Context#
Lookup by ?email= or ?handle= is convenient and sometimes public. The BOLA shape is the same as id tampering: the response or mutation runs for a key the caller should not be able to target, and the same signal as account discovery may appear in error text.
Theory#
The server resolves a stable alternate key to an internal id and then continues without a policy join to the current subject. Batch “search” endpoints that return full objects for partial matches increase blast radius.
Practice#
Query with a peer’s email in scope#
- With two test accounts, call the lookup using the other user’s email or public handle. Compare status, body size, and timing to a non-existent key in the same request shape.
Tools#
- curl
- Burp Suite