The app performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. An adversary could bypass intended access restrictions to read sensitive data or access high privileged area.

Remediation

Ensure that access control checks are performed related to the business logic.

Metadata

• Severity: critical
• Slug: incorrect-authorization

CWEs

• 305: Authentication Bypass by Primary Weakness
• 639: Authorization Bypass Through User-Controlled Key
• 863: Incorrect Authorization

OWASP

• A01:2021: Broken Access Control