CWE-286 Incorrect Authorization

Coverage: 6 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 6 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged an authorization check that is missing, incomplete, or applied in the wrong place. Authorization is "are you allowed to do this?" (not just "are you logged in?").

Why it matters

Incorrect authorization can expose protected data or actions.

• IDOR/data leaks: users can access other users' resources by changing IDs.
• Privilege escalation: normal users can reach admin-only actions.
• Integrity loss: unauthorized edits/deletes.

Safer examples

1) Enforce object-level authorization (ownership/policy)

doc = get_doc(doc_id)
if doc.owner_id != current_user.id:
    raise PermissionError("Forbidden")

2) Centralize authorization checks

Use policy functions/middleware so every route follows the same rules.

3) Test "can't access others' data"

Add integration tests that try another user's ID and assert 403/404.

How SiteShadow detects it (high level)

• Detects record lookups by request-derived IDs and checks for nearby permission checks.
• Flags sensitive operations lacking authorization gates.

References

• CWE-286: https://cwe.mitre.org/data/definitions/286.html

---

← Back to Vulnerability Library