# The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API

Airline GraphQL booking API lacked object-level authz on sequential booking IDs, letting an anonymous session read and modify any passenger's itinerary and PII.

- Payout: Research
- Severity: critical
- Program: Airline
- Credited: Wiz Research
- Disclosed: 2026-06-29
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/red-agent-pov-bola
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-red-agent-pov-bola
- Tags: domain:api domain:web3 impact:data-leak impact:pii-leak kind:research platform:threat-intel sev:critical tech:graphql tech:rest technique:js-analysis vuln:access-control vuln:auth-bypass vuln:idor

**Target:** GraphQL booking API and REST booking endpoints
**Root cause:** GraphQL resolvers (e.g. bookingRetrieveByBookingId) accepted sequential integer booking IDs without verifying the caller's ownership or role; anonymous session tokens carried full resolver access.
**Steps:**
1. Fetch homepage JS bundles to extract API gateway subdomain and token flow
2. `POST /api/kdf/v2/token` with `{"credentials":{"channelType":"DigitalWeb"}}` to get initial token
3. `GET /api/kdf/v1/token` with `Authorization: Bearer <initial_token>` to mint anonymous session token
4. Run GraphQL introspection on `/api/v1/graph` with anonymous token; enumerate 514 queries / 428 mutations
5. Send `mutation { bookingRetrieveByBookingId(bookingId: 144...) { recordLocator passengers {...} contacts {...} journeys {...} } }`
6. Iterate sequential IDs (tested 20) to confirm systemic access
7. Cross-validate via `GET /api/kdf/v1/booking/passengers|contacts|payments`
**How found:** Agent read client-side JS to map backend and token flow, minted anonymous session with empty credentials, introspected GraphQL schema, flagged mutations taking simple integer params, and hypothesized missing backend authz on bookingRetrieveByBookingId.
**Exploitation:** Anonymous session token from empty-credential token flow granted access to all GraphQL resolvers; sequential bookingId enumeration returned full PII and itineraries, and mutations allowed modifying contacts, deleting flight segments, splitting groups, zeroing prices, and issuing refunds.
**Escalation:** Anonymous token escalated to full read/write over active bookings, enabling account hijack via contact email change and financial loss via refund/priceOverride mutations.
**Insight:** Introspect GraphQL schemas with the lowest-privilege token you can mint (even anonymous) and prioritize mutations/queries taking bare integer IDs — those are prime BOLA candidates; empty-credential token flows often yield sessions with far more resolver access than intended.