Notifications
Clear all
Topic starter
06/09/2026 3:45 pm
TL;DR: Authorization failures such as BOLA and IDOR remain the most common API breach path because valid, authenticated requests can still reach objects the caller should never see, according to LEVO's analysis. The real control gap is not traffic inspection but runtime object-level authorisation, where identity-to-resource relationships must be enforced on every request.
NHIMG editorial — based on content published by LEVO: API authorization failures, BOLA and IDOR, and the limits of WAF-based defense
By the numbers:
- Lack of credential rotation is cited as the top cause of NHI-related attacks by 45% of organisations, followed by inadequate monitoring and logging at 37% and over-privileged accounts at 37%.
Questions worth separating out
Q: What breaks when GraphQL APIs do not enforce object-level authorization?
A: The application can authenticate a user and still allow that user to access or change records they do not own.
Q: Why do valid API requests still create breach risk?
A: Valid API requests still create breach risk because authentication proves the caller is known, not that the caller is entitled to the specific object.
Q: How do security teams find object-level authorization failures?
A: They need to test every method and route variant against the same record under different users, tenants, and roles.
Practitioner guidance
- Instrument object-level access checks Log every decision that grants access to a business object, including the identity, object ID, endpoint, and enforcement outcome, so you can detect where ownership checks are missing or inconsistent.
- Reconcile authorization logic across services Compare access rules across APIs that touch the same resource type, and flag any endpoint that relies on UI-layer controls, upstream trust, or partial validation.
- Baseline normal identity-to-object behaviour Build behavioural baselines for which identities normally access which object classes, then alert on unusual cross-tenant, cross-account, or cross-object access sequences.
What's in the full article
LEVO's full article covers the operational detail this post intentionally leaves for the source:
- Endpoint-by-endpoint breakdown of how BOLA and IDOR manifest in live API traffic
- Request-inspection examples showing why traditional WAFs miss object-level entitlement failures
- Operational distinctions between API WAF coverage and runtime authorization enforcement
- Implementation considerations for correlating identity, object, and context across services
👉 Read LEVO's analysis of why API authorization failures defeat WAF-based defense →
BOLA and IDOR: what IAM and AppSec teams miss at runtime?
Explore further
06/09/2026 3:45 pm
Authorization failure is now the decisive API security problem. Perimeter tooling can filter malformed traffic, but it cannot prove that a valid identity is entitled to a specific object. That shifts the centre of gravity from edge inspection to entitlement enforcement, which is exactly where many enterprises are least mature. For IAM and AppSec leaders, the practical conclusion is that object-level access control must be treated as a runtime control plane, not a code review checkbox.
A question worth separating out:
Q: Should organisations rely on WAFs or API WAFs to stop BOLA and IDOR?
A: No. WAFs and API WAFs are useful for request hygiene, schema enforcement, and boundary control, but they cannot reliably determine whether a caller is entitled to a specific object. They reduce noise, while the authorization decision still has to be enforced in the application or service.
👉 Read our full editorial: API authorization failures expose the limits of WAF-based defense
