Cross-Evidence Authorization State Learning for Runtime Detection of Broken Object-Level Authorization in Black-Box Web Applications

Broken object-level authorization BOLA remains difficult to detect in black-box Web applications because external runtime monitors generally lack access to source code, authorization policies, and object-ownership records. This paper proposes a cross-evidence authorization-state learning method...