BOLA (Broken Object Level Authorization)

The #1 flaw in the OWASP API Security Top 10, corresponding to insufficient access control at the object level. BOLA is the API version of IDOR: the attacker manipulates object identifiers in API requests to access other users' data. It is systematically tested during API security audits.