other

BOLA / IDOR

Broken Object Level Authorization, formerly Insecure Direct Object Reference: missing object-level access control despite present authentication, named by the post as the defect class.

Known aliases

Broken Object Level Authorization
Insecure Direct Object Reference

Relationships

No evidence-backed relationships are recorded.

Current clusters

build1 distinct publisher

AI writes the login check and skips the ownership check. IDOR is now the default review item.

A dev.to post walks through a Rails action that authenticates the caller and then loads any invoice by id. The defect is an absence, and the model's own tests confirm it.

Publishers:dev.to

Reality

Evidence48
Adoption: Insufficient
Hype gap+14
Incentives42