// GLOSSARY

BOLA / BFLA

Two core authorization flaws in API security. BOLA (Broken Object Level Authorization) is a horizontal authority violation: accessing another same-level user’s object. BFLA (Broken Function Level Authorization) is a vertical authority violation: invoking an administrative function that should be unreachable. Both sit in the top three of the OWASP API Security Top 10.