Your API has a bouncer. Very professional. Checks every ID at the door. Unfortunately, once you're inside, you can walk into the kitchen, rearrange everything, and delete someone else's reservation and he's still at the front door, extremely proud of himself.
Most security teams know what BOLA is. Broken Object Level Authorization, the vulnerability where an API doesn't verify that you're allowed to access the specific object you're referencing, not just the endpoint. It has sat at the top of the OWASP API Security Top 10 since 2019. There are guides, courses, and CTF challenges built around it.
And yet we analyzed over 100 validated, publicly disclosed bug bounty reports from HackerOne spanning 2021 to 2026, across 29 organizations including GitHub, GitLab, Shopify, Mozilla, and more, and found something that should give every security team pause.
The way most teams are testing for BOLA doesn't match how BOLA actually shows up in the wild. Here's what the data says.
First, a Quick Note on the Tag Noise
One number worth flagging: roughly 39% of reports tagged IDOR or Improper Access Control on HackerOne don't describe BOLA under rigorous criteria. Wrong vulnerability class entirely, auth bypass without object reference, business logic on a user's own resources. If your team is using platform tag-counts to estimate BOLA exposure, you're likely overstating the signal significantly. Hence, these were excluded under the prefilter criteria of our research.
Finally, the 84 confirmed, in-scope reports are what everything below is drawn from. The full dataset, classification methodology, and analysis scripts are available on GitHub.
