Property-level authorization failures happen when APIs correctly authorize object access but fail to enforce permissions for specific fields inside that object. Attackers read or modify sensitive properties such as role flags, internal statuses, pricing controls, or hidden metadata. This often appears in generic PATCH handlers and overbroad serializers.
Implement field-level access policies for read and write operations. Enforce property allowlists per role, endpoint, and action, and reject unauthorized fields explicitly. Use separate DTOs for each permission context and test for horizontal and vertical escalation through partial updates.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
2023Latest
#03api03-2023 Broken Object Property Level Authorization
