SCP05 Access Control
What this means
SiteShadow flagged access control/authorization patterns that appear missing, inconsistent, or bypassable. Authorization is "is this user allowed to do this action on this resource?" (not just "are they logged in?").
Why it matters
Unauthorized access can lead to data leakage or privilege escalation.
- IDOR/data leaks: users can access other users' objects by changing IDs (see
CWE-286/CWE-863). - Privilege escalation: normal users can call admin-only actions.
- Integrity loss: unauthorized edits and deletes.
Safer examples
1) Enforce object-level authorization (Python)
doc = get_doc(doc_id)
if doc.owner_id != current_user.id:
raise PermissionError("Forbidden")2) Centralize authorization
Use shared middleware/policies so every route is protected consistently.
3) Add negative tests for access control
Tests should assert "User A cannot access User B's data" and that admin-only endpoints reject normal users.
How SiteShadow detects it (high level)
- Detects request-derived IDs used to load objects and checks for nearby permission checks.
- Flags sensitive operations that lack authorization gates.
References
- OWASP Secure Coding Practices: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/
---