Issue Details
Broken Object Level Authorization
api01-2019 • Rank #1 in OWASP 2023
Explanation
Object-level authorization failures happen when an API trusts a user identity but does not verify ownership or access policy for each specific object requested. Attackers enumerate identifiers in paths, query strings, or payloads to access neighboring tenant or account data. The risk expands in microservice systems where one service assumes another already checked access, resulting in inconsistent enforcement and silent data exposure across endpoints.
Remedy
Enforce authorization at the object boundary on every read, write, and delete operation. Use centralized policy checks and require explicit ownership or entitlement validation before data access. Add negative tests for ID tampering, include tenant-scoped identifiers, and monitor repeated object-ID probing to detect enumeration attempts early.
| Year | Rank | Category |
|---|---|---|
| 2019 | #1 | api01-2019 - Broken Object Level Authorization |