CWE Top 25 2025, rank 17CWE-863
Incorrect Authorization
CWE-863: Incorrect Authorization
Incorrect authorization differs from missing authorization: a check exists, but it is wrong. The logic might test the wrong attribute, trust a value the client can change, apply the rule to some code paths but not others, or fail open when something unexpected happens. The result is the same as having no check for the cases the faulty logic lets through, and these bugs are harder to find because a quick review sees that a check is present.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- An API checks that the caller is an administrator of some organization, but not of the organization whose data is being changed.
- Authorization reads the user's role from a client-editable cookie or JWT field that is never verified against the server.
- The web route enforces a permission, but the equivalent GraphQL mutation or bulk export endpoint does not.
How to mitigate it
- Derive identity and roles from trusted server-side state, never from client-supplied values.
- Express authorization rules in one policy layer and apply the same policy to every interface that reaches the data.
- Fail closed: if the check errors or cannot determine the answer, deny the request.
- Test authorization with a matrix of users, roles, and tenants, including cross-tenant cases.
Go deeper
Practice this topic
Test your knowledge of Incorrect Authorization with exam-style practice questions.