---
id: 6806
title: "The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/red-agent-pov-bola"
published_at: "2026-06-29T09:31:40Z"
tags: ["data-exposure", "api-security", "graphql", "bola", "authorization-bypass", "red-agent"]
phying_url: "https://phying.com/item/6806"
lang: en
---

# The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API

## Summary

Part 2 of the Red Agent POV series: an autonomous BOLA exploit against an airline's GraphQL booking API used sequential IDs to read two years of passenger records and even modify live bookings.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-06-29T09:31:40Z
- **Original:** https://www.wiz.io/blog/red-agent-pov-bola
- **Phying News:** https://phying.com/item/6806