Broken Object Property Level Authorization occurs when APIs fail to enforce access controls on individual object properties, allowing attackers to read or modify fields they should not have access to, even if overall object access is restricted.

Remediation

• Enforce fine-grained, server-side authorization for each object property based on the authenticated user's permissions.
• Validate and filter request payloads to ensure users cannot modify restricted fields.
• Ensure responses only include properties the requesting user is authorized to view.

Metadata

• Severity: medium
• Slug: broken-object-property-level-authorization

CWEs

• 639: Authorization Bypass Through User-Controlled Key
• 284: Improper Access Control
• 285: Improper Authorization

OWASP

• API1:2023: Broken Object Level Authorization
• API3:2019: Excessive Data Exposure