Field notes
Object-level authorization gaps we still find in 2026
— Partner tokens, nested resources, and the checklist item everyone marks done too early.
Broken object-level authorization remains one of the most common high-severity findings in our secure code reviews. Teams test login thoroughly and still forget to ask, for every read and write: does this caller own this object?
Where it hides
- Partner API tokens that inherit broader internal roles
- Nested resources (
/orders/{id}/lines/{lineId}) checked only at the parent - Admin “impersonation” helpers left reachable from support roles
- Exports that filter in the UI but not in the query
What we ask during intake
Bring a list of privileged reads and writes. We will sample them with horizontal and vertical privilege cases. If your test suite never creates two tenants and swaps identifiers, assume the gap is untested.
Hardening follow-through
A one-line ownership check is cheap compared to a partner incident. After review, our hardening advisory often pairs with adding regression tests that fail when the check is removed.