Skip to content

Action-Level Object BOLA

Named by 2 kept items in this workspace.

Search every workspace for Action-Level Object BOLA. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • BOLA in the Wild
    article2026-08-21

    Unauthorized state-changing action (delete, modify, approve, transfer, trigger) performed on another user's object despite the caller having legitimate access to the endpoint itself

  • All That Glitters Isn't Prompt Injection: Rethinking The Meta Instagram Takeover - APIsec Research Labs
    article2026-06-25It is written here as Action-Level Object BOLA (Broken Object-Level Authorization).

    Per the site's taxonomy: an attacker performs an unauthorized state-changing action (modify, delete, approve, trigger) on another user's object because the authorization check that should bind the action to the requester's own authenticated session never runs; here the 'link new recovery email' func

All techniques in this workspace.