OWASP API1:2023 · CWE-639 · Cross-Tenant BOLA Matrix
Broken Object Level Authorization (BOLA / IDOR) Differential Matrix
Controlled 4-principal replay comparing Resource Owner, Cross-Tenant Peer, Anonymous, and Admin responses against ORM AST predicates.
| API Endpoint | Owner (Tenant B) | Cross-Tenant (Tenant A) | Anonymous | Admin Role | Proof Verdict |
|---|---|---|---|---|---|
| GET /api/v2/users/{id} | 200 OK (Own Record) | 200 OK (LEAKS PII) | 401 Unauthorized | 200 OK (Authorized) | CONFIRMED BOLA (API-001) |
| GET /api/v2/invoices/{id} | 200 OK | 403 Forbidden | 401 Unauthorized | 200 OK | VERIFIED SAFE |
| PUT /api/v2/users/{id} | 200 OK (Mass Assign) | 403 Forbidden | 401 Unauthorized | 200 OK | BOPLA / MASS ASSIGN (API-006) |
| DELETE /api/v2/orgs/{id}/members/{member_id} | 403 Forbidden | 403 Forbidden | 401 Unauthorized | 204 No Content | VERIFIED SAFE |
Static ORM Query AST & Remediation for `GET /api/v2/users/{id}`
Observed Controller ORM Sink
session.query(User).filter(User.id == id).first() # Missing tenant_id predicate
Verified Tenancy Predicate Fix
session.query(User).filter(User.id == id, User.tenant_id == jwt.tenant_id).first()