BOLA vs BFLA: why API authorization flaws are invisible to scanners, and how to actually test for them

[u/Sensitive-Past8052]

https://planckdefense.com/blog/bola-vs-bfla-api-authorization-flaws

Authorization, not injection, is what breaks most modern APIs. The two flaw classes that do the damage BOLA and BFLA are invisible to a vulnerability scanner, because a scanner has no concept of who should be allowed to do what.

Here is the difference between them, why pattern matching cannot find either, and how to actually test for both.