Step 1 of 6

The check that goes missing

Broken object level authorisation is the most common serious flaw in modern APIs. The endpoint authenticates the caller correctly, then returns the item without checking that this caller is entitled to it. A scanner looks for it by sending attack traffic with test accounts, which means production risk, upkeep, and a large untested remainder.