CWE-863 (授权机制不正确) — Vulnerability Class 2587

CWE-863, Incorrect Authorization, represents a critical logic flaw where software fails to properly verify an actor’s permissions before granting access to resources or executing actions. Attackers typically exploit this vulnerability by manipulating input parameters, such as altering user IDs or session tokens, to bypass intended access controls and interact with data or functions reserved for privileged users. This often leads to unauthorized data disclosure, modification, or complete system compromise. To prevent such breaches, developers must implement robust, centralized authorization checks that are consistently applied across all application layers. Relying solely on client-side restrictions is insufficient; instead, server-side validation should enforce strict role-based or attribute-based access controls for every request, ensuring that permission verification occurs reliably before any sensitive operation is permitted.