BOLA explained with example

OWASP API #1: the server checks you are logged in, but not that the object is yours.

Example

User A GETs /api/orders/10241 (own order). Replays /api/orders/10242 — gets User B name, email, total. 200 OK, no ownership check. We have reproduced this exact class as Critical: “any authenticated user can read another tenant's records.”

Fix

Server-side ownership check on every object read/write; deny by default; tests for cross-tenant IDs; audit logging.

How we test

Enumerate endpoints (incl. undocumented), replay each call across role + tenant, probe pricing/limits/workflows — API testing.