CWE-863 Incorrect Authorization
What this means
SiteShadow flagged an authorization check that appears missing or incorrect. Authentication answers "who are you," authorization answers "are you allowed to do this."
Why it matters
Incorrect authorization can lead to privilege escalation.
- IDOR/data leaks: users can access other users' records by changing IDs.
- Privilege escalation: a normal user can call admin-only actions.
- Integrity loss: unauthorized edits/deletes.
Safer examples
1) Enforce object-level authorization (ownership/policy)
doc = get_doc(doc_id)
if doc.owner_id != current_user.id and not current_user.is_admin:
raise PermissionError("Forbidden")2) Use centralized policies/guards
Don't scatter checks across handlers; use middleware/policy functions.
3) Test "can't access others' data"
Add integration tests that attempt access with a different user and assert 403/404.
How SiteShadow detects it (high level)
- Detects record lookup by request-derived IDs and checks for nearby permission checks.
- Flags sensitive operations without clear authorization enforcement.
References
- CWE-863: https://cwe.mitre.org/data/definitions/863.html
---