CWE-863 Incorrect Authorization

Coverage: 7 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 1Other-pattern 6 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged an authorization check that appears missing or incorrect. Authentication answers "who are you," authorization answers "are you allowed to do this."

Why it matters

Incorrect authorization can lead to privilege escalation.

• IDOR/data leaks: users can access other users' records by changing IDs.
• Privilege escalation: a normal user can call admin-only actions.
• Integrity loss: unauthorized edits/deletes.

Safer examples

1) Enforce object-level authorization (ownership/policy)

doc = get_doc(doc_id)
if doc.owner_id != current_user.id and not current_user.is_admin:
    raise PermissionError("Forbidden")

2) Use centralized policies/guards

Don't scatter checks across handlers; use middleware/policy functions.

3) Test "can't access others' data"

Add integration tests that attempt access with a different user and assert 403/404.

How SiteShadow detects it (high level)

• Detects record lookup by request-derived IDs and checks for nearby permission checks.
• Flags sensitive operations without clear authorization enforcement.

References

• CWE-863: https://cwe.mitre.org/data/definitions/863.html

---

← Back to Vulnerability Library