Issue Details
Broken Object Property Level Authorization
api03-2023 • Rank #3 in OWASP 2023
Explanation
Property-level authorization failures happen when APIs correctly authorize object access but fail to enforce permissions for specific fields inside that object. Attackers read or modify sensitive properties such as role flags, internal statuses, pricing controls, or hidden metadata. This often appears in generic PATCH handlers and overbroad serializers.
Remedy
Implement field-level access policies for read and write operations. Enforce property allowlists per role, endpoint, and action, and reject unauthorized fields explicitly. Use separate DTOs for each permission context and test for horizontal and vertical escalation through partial updates.
| Year | Rank | Category |
|---|---|---|
| 2023 | #3 | api03-2023 - Broken Object Property Level Authorization |