BOLA occurs when APIs fail to enforce object-level access control, allowing attackers to manipulate object IDs and access or modify data belonging to other users.
Object ID Manipulated → API Request Sent → Access Control Missing → Unauthorized Data Accessed → Authorization Fixed
