🧪 Labs › Access Control
Broken Object-Level Authorization (BOLA)
Severity: High
An API hands you any record by id — without checking it's yours. IDOR for APIs.
What it is
BOLA is the API form of IDOR, and the number-one API security risk. An endpoint like GET /api/users/{id} takes an object reference and returns the object, but never checks that the caller owns it.
APIs make this worse than classic web IDOR: ids are everywhere, endpoints are numerous and often undocumented, and the mobile/JS client usually only ever requests your own id, so the missing check goes unnoticed.
The result is bulk data exposure — walk the ids and read every user's record.
How to approach it
- Capture a request that fetches an object by an id that belongs to you.
- Change the id to one that belongs to another account and see whether the API still returns it.
- Try sequential and guessed ids; check both reads and writes.
- Look for sibling endpoints that take the same id — the check may be present on one and missing on another.
Your task
Read another user's record through the API by changing the object id.
▶ Access the labOpens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.
How to prevent it
- Enforce an ownership/authorization check on every object access, derived from the session — never from the request.
- Don't rely on unguessable ids as the control.
- Test authorization per endpoint; a shared id doesn't mean a shared check.
More Access Control labs
- Insecure Direct Object References (IDOR) — The app checks the number on the door, not whether the door is yours.
- Broken Function-Level Authorization (BFLA) — A privileged action that only the UI hides — call it directly and it runs.