Broken Object Level Authorization (BOLA)

Broken Object Level Authorization is a flaw in which a service lets an authenticated caller read or change an object by naming it, without checking that this caller may touch that particular object. It is also called insecure direct object reference (IDOR). OWASP lists it first in its API Security Top 10 (2023 edition).