CWE Top 25 — #24
Incorrect Authorization
CWE-863Authorisation is implemented but wrong — checking the wrong field, comparing strings non-constant-time, or allowing the user to set their own role.
GateTest coverage
Not directly covered today. GateTest has no dedicated rule for this class yet — it depends on application logic or runtime behaviour a static pattern cannot see. The remediation below says which adjacent GateTest checks apply.
Example
if (req.body.role === 'admin') grantAdmin() — trusting a client-provided role field.
How to fix it
Authorisation belongs server-side, against persisted state. Never accept role / permission claims from the client. Use a vetted policy library (Casbin, OPA). GateTest's authBypass module covers missing authentication (CWE-306), not wrong authorisation logic — this class needs a policy review and a two-account test today.
Frequently asked questions
What is CWE-863 (Incorrect Authorization)?
Authorisation is implemented but wrong — checking the wrong field, comparing strings non-constant-time, or allowing the user to set their own role.
How do I fix incorrect authorization?
Authorisation belongs server-side, against persisted state. Never accept role / permission claims from the client. Use a vetted policy library (Casbin, OPA). GateTest's authBypass module covers missing authentication (CWE-306), not wrong authorisation logic — this class needs a policy review and a two-account test today.
Does GateTest detect CWE-863?
Not with a dedicated rule today. Incorrect Authorization depends on application logic or runtime behaviour that a static pattern cannot see on its own. Authorisation belongs server-side, against persisted state. Never accept role / permission claims from the client. Use a vetted policy library (Casbin, OPA). GateTest's authBypass module covers missing authentication (CWE-306), not wrong authorisation logic — this class needs a policy review and a two-account test today.
What rank is Incorrect Authorization in the CWE Top 25?
Incorrect Authorization is ranked #24 in the MITRE 2023 CWE Top 25 Most Dangerous Software Weaknesses list. The ranking reflects both prevalence (how often it appears in real CVEs) and severity (the typical impact when it's exploited).