Broken Object/Function Level Authorization (BOLA/BFLA)

SkillAI & models

Broken Object/Function Level Authorization in REST/JSON APIs (the #1 API risk). Load on any REST API with object ids in paths/bodies (/api/v1/users/123, /orders/{id}), Bearer auth, mobile-app backends, or admin vs user function separation. Signals: predictable ids, verbs that skip re-authorization, "role" enforced only in the UI.

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

Add ahel to your AI once: Claude, ChatGPT, Cursor, Claude Code or Codex. Then ask it to use this.

Then ask your AI: use the Broken Object/Function Level Authorization (BOLA/BFLA) skill

What this skill tells your AI

The instructions your AI receives, as published by noorqureshi/sploitagent in skills/api/api-bola/SKILL.md and read by ahel’s review.

When it applies

An API exposes objects (BOLA) or privileged functions (BFLA) and enforces authorization weakly. The API version of IDOR — but APIs multiply the surface (many endpoints, verbs, versions, and a mobile client that trusts the server less than the web UI does).

Why it works

APIs are stateless and object-centric; each endpoint must independently check "can this token act on this object/function?". Teams centralize authentication but scatter (or forget) authorization, and hide admin functions in the client instead of the server.

Method

BOLA: with two tokens, request another user's object id on every endpoint & verb; also try guessing/incrementing ids and IDs leaked from list endpoints.
BFLA: take an admin-only call (from JS, mobile, or docs) and replay it with a low-priv token; try method swaps (GET→PUT/DELETE) and hidden verbs the UI never issues.
Version & shadow endpoints: /api/v1/ may lack fixes present in /v2/; /internal/, /debug/, Swagger/OpenAPI docs reveal ungoverned routes.
Automate with Burp Autorize (low-priv token as the "enforcement" session) to flag every request that succeeds when it shouldn't.

Gotchas

200 vs 403 is the tell, but some APIs return 200 with an empty body — diff the content.
IDs as UUIDs still leak via list/search endpoints and other objects' relations.
Rate-limit and WAF differ per API version — the vuln may only show on an older route.

Verify success

A low-privilege (or cross-tenant) token successfully reads/modifies an object or invokes a function reserved for another user/role.

References

OWASP API Security Top 10 (2023) API1/API5; PortSwigger access-control labs.

Signals

GitHub stars: 20
Forks: 7
Last commit: Sep 2026

Advanced

Item type: skill
Key: api-bola
Source: github.com/noorqureshi/sploitagent

github.com/noorqureshi/sploitagent