Technical Summary: Broken Object Level Authorization in the Wild

Problem Statement

Broken Object Level Authorization (BOLA) is consistently ranked as the most critical vulnerability in the OWASP API Security Top 10. Despite its prominence, existing literature regarding BOLA remains almost entirely conceptual. Current guidance relies on illustrative examples, single-case narratives, or abstract access control models, lacking an empirical account of how BOLA manifests in production environments. There is a significant gap in understanding the real-world distribution of BOLA patterns, the specific identifier types involved, the actions attackers perform, and the industries most exposed. Furthermore, the relationship between the mechanism (Insecure Direct Object Reference, or IDOR) and the root cause (BOLA) is frequently conflated in practitioner literature and bug bounty tagging, leading to potential measurement errors in security assessments.

Methodology

This paper presents a large-scale empirical analysis of BOLA using publicly disclosed bug bounty reports as the primary data source.

• Data Source: The study utilized the HackerOne Hacktivity public disclosure dataset, querying for reports tagged with "IDOR" or "Improper Access Control" between January 2021 and January 2026.
• Sampling: A reproducible sampling frame of 200 reports was constructed.
• Filtering: A three-criterion inclusion filter was applied to ensure reports referenced a specific concrete object, demonstrated cross-boundary access to another user's/tenant's object, and contained technical details. This reduced the sample to 122 eligible reports.
• Classification: An LLM-assisted schema-completion procedure was employed using a refined six-family BOLA taxonomy. The LLM acted as a constrained extraction assistant under human-adjudicated criteria. Low-confidence outputs and specific boundary cases were reviewed by human raters to ensure accuracy.
• Final Dataset: From the 200 initial candidates, 107 reports were fully classified. Of these, 84 (78.5%) were confirmed as in-scope BOLA, while 23 (21.5%) were deemed out-of-scope or unclassifiable under strict criteria.

Key Contributions

1. Refined Taxonomy: The paper introduces a six-family BOLA taxonomy grounded in real disclosures, designed to reduce inter-rater ambiguity. The families are:
   • Direct Object Reference BOLA: Unauthorized access via direct or predictable identifier substitution.
   • Action-Level Object BOLA: Unauthorized state-changing actions (delete, modify, trigger) on another user's object.
   • Tenant Isolation BOLA: Cross-organizational access violations.
   • Workflow-Context BOLA: Authorization bypasses dependent on object state (e.g., draft, archived, deleted).
   • Chained Disclosure BOLA: Exploitation requiring a prior step to harvest an identifier from a separate endpoint.
   • Object Rebinding BOLA: Manipulation of ownership-identifying fields in the request to change authorization scope.
2. Methodological Framework: A reproducible classification methodology combining LLM assistance with structured human review is documented for replication.
3. Label Noise Characterization: The study quantifies the divergence between platform tagging (IDOR/Improper Access Control) and confirmed in-scope BOLA, revealing significant label noise.
4. Empirical Baseline: The paper provides quantitative distributions across six dimensions: family, action type, authorization direction, industry sector, identifier format, and exploit mechanism.

Key Results

Based on the 84 confirmed in-scope reports:

• Family Distribution: Action-Level Object BOLA (41.7%) and Direct Object Reference BOLA (36.9%) are the two dominant families, jointly accounting for 78.6% of cases. This indicates that unauthorized state-changing actions are as prevalent as, or more prevalent than, simple read-access violations.
• Authorization Direction: Horizontal failures (peer-to-peer) dominate at 85.7%. However, Vertical failures (user-to-admin) account for 11.9%, a pattern often underrepresented in developer guidance but carrying high impact.
• Action Types: While unauthorized Read is the most common single action (52.4%), state-changing actions (Modify, Delete, Trigger) collectively account for 46.4% of cases.
• Identifier Formats: Sequential integers remain the most frequently evidenced identifier type (36.9% of known-format cases). However, non-sequential formats (UUIDs, encoded IDs, usernames, emails) account for 39.2% of known-format cases, demonstrating that opaque identifiers do not eliminate BOLA risk.
• Exploit Mechanisms: Sequential integer enumeration is the most prevalent mechanism (22.6%). GraphQL Global IDs (GIDs) are systematically exploited via a decode/increment/re-encode pattern, as the underlying integers remain sequential despite base64 encoding.
• Label Noise: Only 42.0% of the 200 sampled reports tagged as IDOR/Improper Access Control were confirmed as in-scope BOLA. Approximately 21.5% of classified reports were out-of-scope under strict criteria, indicating that tag-counting on platforms like HackerOne significantly overstates the BOLA-specific signal.
• Industry and Severity: SaaS & Productivity dominates the dataset (44.0%). While the median severity is Medium, 35.7% of reports are rated High or Critical, with Action-Level Object BOLA carrying disproportionately high severity ratings.

Significance and Claims

The paper claims to address the gap between conceptual BOLA definitions and empirical reality. Its significance lies in:

• Challenging Prevailing Guidance: The findings suggest that current practitioner guidance and OWASP examples may underemphasize Action-Level Object BOLA and Vertical BOLA, focusing too heavily on read-only, horizontal, direct object reference scenarios.
• Testing Protocol Implications: The study argues that standard API security testing protocols, which often focus on GET-method cross-user access, are insufficient. Effective testing must include state-changing operations (POST, PUT, DELETE) and vertical privilege scenarios.
• Design Implications: The persistence of sequential integers in mature security programs (e.g., GitHub, DoD, HackerOne) and the exploitability of GraphQL Global IDs suggest that identifier obfuscation alone is not a sufficient control. Authorization must be re-evaluated when object states change (Workflow-Context).
• Measurement Accuracy: The paper provides evidence that relying on bug bounty platform tags for vulnerability prevalence estimates introduces significant noise, necessitating more rigorous classification for accurate risk assessment.

The authors conclude that their work supplies a vocabulary for realistic attack scenarios, concrete pattern guidance for developers, and an empirical baseline for researchers building detection tools. They explicitly note limitations regarding selection bias (HackerOne coverage), disclosure depth heterogeneity, and the concentration of reports from specific programs (e.g., HackerOne and DoD), qualifying their findings to be robust only where these factors are accounted for via program-weighted analysis.