Security
New empirical study reveals overlooked patterns in API authorization vulnerabilities
Researchers analyzing over 100 bug bounty disclosures find that unauthorized state-changing actions represent a major class of API security flaws that practitioners have underrecognized.
A comprehensive empirical analysis of real-world security vulnerabilities has shed light on patterns in Broken Object Level Authorization (BOLA), one of the most critical API security risks. Researchers examined 107 confirmed cases from publicly disclosed bug bounty reports to map how these authorization failures actually occur in practice.
What the study found#
The research team analyzed HackerOne disclosures between 2021 and 2026, filtering 200 initial reports tagged with IDOR or improper access control issues down to 107 fully classified cases. Of these, 84 (78.5%) qualified as true BOLA incidents. The analysis revealed that Action-Level Object BOLA—where attackers execute unauthorized actions on someone else's objects—accounts for 41.7% of confirmed cases, emerging as a major vulnerability family alongside the more traditionally discussed Direct Object Reference BOLA.
The findings expose a significant gap in current security guidance. Action-level flaws have been largely absent from practitioner documentation, suggesting that API security testing and developer training remain misaligned with real-world attack patterns.
Key patterns and implications#
Additional insights from the 107 classified reports include:
- Vertical privilege escalation failures (user-to-admin elevation) occur in approximately 11.9% of cases
- GraphQL Global IDs are systematically exploited across major platforms
- About 21.5% of tagged reports in the dataset actually fall outside strict BOLA criteria, indicating that tag-based vulnerability counting on platforms like HackerOne inflates the true BOLA signal
- Variations span identifier formats, authorization directions, industry sectors, and exploitation mechanisms
The researchers employed an LLM-assisted classification procedure under human oversight, applying a six-family BOLA taxonomy to ensure reproducible results.
What this means#
These findings directly challenge the conceptual understanding of API security that has dominated the field. By grounding analysis in actual disclosed vulnerabilities rather than theoretical models, the work offers clearer priorities for API security testing protocols, developer education programs, and updates to OWASP guidance on this critical risk category.
