API3:2023 - Broken Object Property Level Authorization (BOPLA)

Imagine filling out a standard change-of-address form at the bank, but you also write "Account Balance: $1,000,000" in the margins—and the teller actually updates your balance. In APIs, BOPLA happens when endpoints allow users to read or write specific object properties (fields) that they shouldn't have access to. It combines two classic vulnerabilities: Mass Assignment (updating fields you shouldn't, like isAdmin: true) and Excessive Data Exposure (the API returning the entire user record, including password hashes, and relying on the frontend to filter it out).