{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2022:TBBFIM3R7JMYP4JTP2WBWHQ4GA","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"2f62a903b27bf288376d51d8e713117050cc4b8a44bd6fea04ecbeccaefa1271","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-26T09:25:05Z","title_canon_sha256":"0ff4068eefb4a80b75ebfda7887ad48e780d7a48cea1ec019f0593ee5cca9571"},"schema_version":"1.0","source":{"id":"2201.10833","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2201.10833","created_at":"2026-07-05T03:51:50Z"},{"alias_kind":"arxiv_version","alias_value":"2201.10833v1","created_at":"2026-07-05T03:51:50Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2201.10833","created_at":"2026-07-05T03:51:50Z"},{"alias_kind":"pith_short_12","alias_value":"TBBFIM3R7JMY","created_at":"2026-07-05T03:51:50Z"},{"alias_kind":"pith_short_16","alias_value":"TBBFIM3R7JMYP4JT","created_at":"2026-07-05T03:51:50Z"},{"alias_kind":"pith_short_8","alias_value":"TBBFIM3R","created_at":"2026-07-05T03:51:50Z"}],"graph_snapshots":[{"event_id":"sha256:46f8e145fee204a8a9f3855dd145baaa66878f25cdd9529708cfda599e2c39ed","target":"graph","created_at":"2026-07-05T03:51:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2201.10833/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Objective. Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) are one of the critical type of access control vulnerabilities for modern applications. As a result, an attacker can bypass authorization checks leading to information leakage, account takeover. Our main research goal was to help an application security architect to optimize security design and testing process by giving an algorithm and tool that allows to automatically analyze system API specifications and generate list of possible vulnerabilities and attack vector ready to be used as security non-f","authors_text":"Aleksey Teplov, Alexander Barabanov, Denis Dergunov, Denis Makrushin","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-26T09:25:05Z","title":"Automatic detection of access control vulnerabilities via API specification processing"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2201.10833","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:6a1f1210a8b28df9b6d0d605308b7092e902f9901eaa5f974d351e27e133b62d","target":"record","created_at":"2026-07-05T03:51:50Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"2f62a903b27bf288376d51d8e713117050cc4b8a44bd6fea04ecbeccaefa1271","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2022-01-26T09:25:05Z","title_canon_sha256":"0ff4068eefb4a80b75ebfda7887ad48e780d7a48cea1ec019f0593ee5cca9571"},"schema_version":"1.0","source":{"id":"2201.10833","kind":"arxiv","version":1}},"canonical_sha256":"9842543371fa5987f1337eac1b1e1c3039858f4cd9014007ed8b3111fc20f126","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"9842543371fa5987f1337eac1b1e1c3039858f4cd9014007ed8b3111fc20f126","first_computed_at":"2026-07-05T03:51:50.082591Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T03:51:50.082591Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"eNIAIkYnlVwlTEyX1oUfwqQtQgc24NIa9/ajJPYyx5NVpO8Z1B+MlvaW7kHjWERD62lzdlHKsG5IW1ZFvfmVDw==","signature_status":"signed_v1","signed_at":"2026-07-05T03:51:50.083007Z","signed_message":"canonical_sha256_bytes"},"source_id":"2201.10833","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:6a1f1210a8b28df9b6d0d605308b7092e902f9901eaa5f974d351e27e133b62d","sha256:46f8e145fee204a8a9f3855dd145baaa66878f25cdd9529708cfda599e2c39ed"],"state_sha256":"d6dd6e109a328345df1cbb863508df02c6f49e8ea0e4f273f70442b75aa826f4"}