BOLABuster

Mentions · 7d0
Mentions · 30d0
All mentions1
First seenAug 17, 2026
Last mentionedAug 17, 2026

Timeline

1 articles · newest first

Harnessing LLMs for Automating BOLA Detection

Unit 42's BOLABuster methodology uses LLMs to automate detection of broken object-level authorization vulnerabilities, uncovering flaws in Grafana, Harbor, and Easy!Appointments.

Palo Alto Unit 42Aug 17, 12:34 UTC · Aug 17, 2026ResearchCVE-2024-1313 CVE-2024-22278 CVE-2023-3285+141

Related CVEs

by mentions

CVE-2023-3288<1%8.8
A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user (provider) in the system
published Jul 9, 2024easyappointments easyappointments
CVE-2023-3287<1%8.8
A BOLA vulnerability in POST /admins allows a low privileged user to create a high privileged user (admin) in the system
published Jul 9, 2024easyappointments easyappointments
CVE-2023-38051<1%8.1
A BOLA vulnerability in GET, PUT, DELETE /secretaries/{secretaryId} allows a low privileged user to fetch, modify or delete a low privileged user (secretary)
published Jul 9, 2024easyappointments easyappointments
CVE-2023-38054<1%8.1
A BOLA vulnerability in GET, PUT, DELETE /customers/{customerId} allows a low privileged user to fetch, modify or delete a low privileged user (customer)
published Jul 9, 2024easyappointments easyappointments
CVE-2023-38050<1%8.1
A BOLA vulnerability in GET, PUT, DELETE /webhooks/{webhookId} allows a low privileged user to fetch, modify or delete a webhook of any user (including admin)
published Jul 9, 2024easyappointments easyappointments
CVE-2023-3285<1%7.7
A BOLA vulnerability in POST /appointments allows a low privileged user to create an appointment for any user in the system (including admin)
published Jul 9, 2024
CVE-2024-1313<1%6.5
It is possible for a user in a different organization from the owner of a snapshot to bypass authorization and delete a snapshot by issuing a DELETE request to…
published Mar 26, 2024
CVE-2023-3289<1%6.5
A BOLA vulnerability in POST /services allows a low privileged user to create a service for any user in the system (including admin)
published Jul 9, 2024easyappointments easyappointments
CVE-2023-3290<1%5.0
A BOLA vulnerability in POST /customers allows a low privileged user to create a low privileged user (customer) in the system
published Jul 9, 2024easyappointments easyappointments
CVE-2024-22278<1%4.3
Incorrect user permission validation in Harbor <v2.9.5 and Harbor <v2.10.3 allows authenticated users to modify configurations
published Aug 2, 2024linuxfoundation harbor

Appears with

Palo Alto Networksorganization · 1
Harborproduct · 1
Unit 42organization · 1
Unit 42threat actor · 1
Easy!Appointmentsproduct · 1
Palo Alto Networksvendor · 1
Grafanaproduct · 1

Entities are extracted by the model from each article. First seen Aug 17, 2026, last mentioned Aug 17, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.