Incorrect Authorization

The app performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. An adversary could bypass intended access restrictions to read sensitive data or access high privileged area.

Remediation

Ensure that access control checks are performed related to the business logic.

Metadata

Severity: critical
Slug: incorrect-authorization

CWEs

305: Authentication Bypass by Primary Weakness
639: Authorization Bypass Through User-Controlled Key
863: Incorrect Authorization

OWASP

A01:2021: Broken Access Control

Available Labs

Open Javascript labs in SecDim Play for this vulnerability.

easy

Middleware.js

JavaScript Easy New Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.