idor-broken-object-authorization

IDOR and BFLA vulnerabilities expose multi-tenant resources by failing to validate object access permissions. This playbook provides a structured methodology to systematically identify and verify these authorization flaws across REST and GraphQL endpoints.

Test for IDOR by manipulating identifiers in API paths, queries, bodies, headers, and nested objects to detect horizontal and vertical privilege escalation. This playbook provides structured cross-cutting checks to verify unauthorized multi-tenant resource access.

Yes, this methodology applies cross-cutting checks for BOLA and BFLA across both GraphQL and REST endpoints. It specifically targets multi-tenant and user-scoped resources to uncover horizontal and vertical privilege escalation vulnerabilities.

Document IDOR findings by following this playbook's structured evidence collection and remediation guidance. It provides concrete steps to verify broken object authorization flaws, ensuring outputs are suitable for security reviews and bug bounty reports.

Verify vertical privilege escalation by applying this playbook's cross-cutting BFLA and BOLA checks to multi-tenant APIs. It systematically tests ID manipulation across paths, headers, and nested objects to confirm unauthorized access to higher-privilege resources.