Broken Object Level Authorization (BOLA) happens when an API lets a user access data that belongs to someone else, simply by changing an ID in the request. No malformed payload, no injection string — just a request that looks completely normal.
That’s exactly why signature-based scanners struggle here. They’re built to recognize known-bad patterns: a SQL fragment, a suspicious header, a known exploit signature. BOLA doesn’t look malicious at the request level. It only becomes a problem when you understand what the response actually reveals.
Catching it requires reasoning about the relationship between an authenticated session and the resource it’s requesting — not pattern matching. That’s the gap between a regex-driven scan and genuine logic analysis.
