Broken Object/Function Level Authorization (BOLA/BFLA)

When it applies

An API exposes objects (BOLA) or privileged functions (BFLA) and enforces authorization weakly. The API version of IDOR — but APIs multiply the surface (many endpoints, verbs, versions, and a mobile client that trusts the server less than the web UI does).

Why it works

APIs are stateless and object-centric; each endpoint must independently check "can this token act on this object/function?". Teams centralize authentication but scatter (or forget) authorization, and hide admin functions in the client instead of the server.