Object-level

Insecure direct object references and related issues: unauthorized access to data identified by IDs, slugs, or relationships between records.

1 minutong pagbasana-update Okt 6, 2026

1 contributor

Itanong sa iyong assistant (MCP)I-edit sa GitHub

Ang nilalamang ito ay ipinapakita sa english dahil hindi available sa tagalog.

Object-level access control (BOLA / IDOR) is the failure to verify that the authenticated subject may access this specific resource. The server accepts a reference (ID, UUID, slug) but does not enforce ownership, tenancy, or role on that instance.

Pages#

Direct reference tampering (IDOR)
Batch object operation
Alternate key lookup
Nested object without ownership check
Predictable encoded IDs
Public identifier guessing
Relationship trust mischeck