What is BOLA in web security?

BOLA stands for Broken Object Level Authorization. It is OWASP’s #1 API security risk and one of the most common findings in AI-generated backend code. The vulnerability is not that the route is missing authentication — AI tools add that. It is that the route checks the user is logged in, but does not check that they own the specific record they are requesting.

A concrete example

// VULNERABLE: authenticated but not authorized for ownership
app.get('/api/invoices/:id', requireAuth, async (req, res) => {
  const invoice = await db.invoices.findById(req.params.id);
  res.json(invoice); // returns any invoice to any logged-in user
});

Any logged-in user can change the :id in the URL and read any other user’s invoice. The route is not broken — it does exactly what it was written to do. It was just never written to check ownership.

Why it is OWASP API Security #1

BOLA tops the list because it is simultaneously easy to introduce and trivial to exploit. No special tooling required — just change the ID in the URL and see what comes back. It affects read, update, and delete operations. And it generates no errors: the route responds normally with a 200, so it does not show up in any error monitoring.

Why AI tools ship it constantly

AI coding tools (Cursor, Lovable, Bolt, Claude Code) add the auth middleware because it is a well-defined pattern they have seen thousands of times. The ownership check is more contextual — it requires knowing which field on the model maps to which field on the session user — and in a fast-scaffolded endpoint that knowledge often gets dropped. The endpoint satisfies the feature requirement (retrieve invoice by ID) without the security requirement (only the invoice owner can retrieve it).

The fix

// CORRECT: scope the query to the authenticated user
app.get('/api/invoices/:id', requireAuth, async (req, res) => {
  const invoice = await db.invoices.findOne({
    _id: req.params.id,
    userId: req.user.id, // must belong to the requesting user
  });
  if (!invoice) return res.status(404).json({ error: 'Not found' });
  res.json(invoice);
});

Return 404, not 403, when the record is not found or does not belong to the user — do not confirm the record exists for other users. Apply the same ownership filter to PUT, PATCH, and DELETE routes.

How to audit your codebase for BOLA

• List every route that takes an ID in the URL path, query string, or request body
• For each one, check whether the database query scopes results to the authenticated user
• Test manually: log in as user A and request user B’s resource ID — you should get a 404
• Pay extra attention to routes that were quickly scaffolded or generated by an AI tool, especially CRUD endpoints

BOLA is the authorization equivalent of missing auth entirely. See missing auth on an API route for the authentication check that comes before the ownership check, and the full vibe-coding security checklist for both passes together.

Common questions