API1:2023 Broken Object Level Authorization

An endpoint takes an object id from the path or query and reads or writes that object without checking that the caller may access it. A /users/123/orders/456 endpoint that returns order 456 to anyone is the most common API breach.

What Vulkro detects

Handlers whose route declares an :id-style path or query parameter and whose body reads or writes the named object with no visible ownership check: no .where(user=current_user), no role assertion, no scoping middleware on the route.

Non-compliant code

# Django REST: no owner check
@api_view(['GET'])
def get_order(request, order_id):
    order = Order.objects.get(pk=order_id)
    return Response(OrderSerializer(order).data)  # any caller sees any order

Compliant code

# Django REST: owner predicate on the lookup
@api_view(['GET'])
@permission_classes([IsAuthenticated])
def get_order(request, order_id):
    order = Order.objects.get(pk=order_id, customer=request.user)
    return Response(OrderSerializer(order).data)

References

• CWE-639
• CWE-285
• OWASP API1:2023

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.