Topic
6 articles
CyberSecureToday covers BOLA across 6 articles published between 2 Oct 2026 and 31 Oct 2026.
The coverage includes 2 vulnerability advisories, 1 incident or breach report and 3 analysis or guidance pieces. 2 advisories are rated critical or high severity.
Stories on BOLA most often intersect with API Security, NBFC and FinTech, with Technology, Cloud & SaaS the most affected sector. The most recent story, “CERT-In Issues Critical Advisory CIAD-2026-0046: Threat Actors Weaponize NBFC and FinTech Disbursement APIs”, was published 31 Oct 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.
Gov / DefenseCERT-In issued advisory CIAD-2026-0046 alerting NBFCs and digital lenders that attackers are exploiting flawed APIs to execute unauthorized loan disbursements.
VulnerabilityA comprehensive technical guide to hardening banking and NBFC APIs against BOLA, broken authentication, token replay, and co-lending data leakage.
CMS SecurityA broken object authorization flaw in the WordPress core REST API enabled unauthenticated attackers to read private and hidden bbPress forum posts.
Data BreachThe exfiltration of 8.8M Danish CPR records exposes the systemic risk of partner API queries. Security leaders must replace static trust with verifiable credentials.
Data BreachDanish authorities confirmed an unauthorized entity abused legitimate commercial partner API credentials to exfiltrate 8.8 million CPR citizen identity records.
Threat IntelCISA advisory ICSA-26-274-06 details critical Broken Object Level Authorization in Meari IoT Cloud OpenAPI, exposing millions of surveillance devices worldwide.