CWE-286 Incorrect Authorization
What this means
SiteShadow flagged an authorization check that is missing, incomplete, or applied in the wrong place. Authorization is "are you allowed to do this?" (not just "are you logged in?").
Why it matters
Incorrect authorization can expose protected data or actions.
- IDOR/data leaks: users can access other users' resources by changing IDs.
- Privilege escalation: normal users can reach admin-only actions.
- Integrity loss: unauthorized edits/deletes.
Safer examples
1) Enforce object-level authorization (ownership/policy)
doc = get_doc(doc_id)
if doc.owner_id != current_user.id:
raise PermissionError("Forbidden")2) Centralize authorization checks
Use policy functions/middleware so every route follows the same rules.
3) Test "can't access others' data"
Add integration tests that try another user's ID and assert 403/404.
How SiteShadow detects it (high level)
- Detects record lookups by request-derived IDs and checks for nearby permission checks.
- Flags sensitive operations lacking authorization gates.
References
- CWE-286: https://cwe.mitre.org/data/definitions/286.html
---