CWE-863 is the MITRE weakness class for incorrect authorization. It describes cases where an application does perform access checks, but those checks are wrong, incomplete, or applied at the wrong point in the request flow. The result is that a user or unauthenticated request may reach actions that should have been blocked.
This matters because authorization is the server-side boundary that protects admin features, customer data, and role-based workflows. Attackers look for missing checks, overly broad permissions, or logic flaws that let protected functions execute anyway. In practice, CWE-863 often appears in web apps, APIs, and commerce platforms where custom roles, ACLs, or business rules are complex. Defenders reduce the risk by enforcing deny-by-default server-side checks, testing privileged routes directly, reviewing custom authorization logic, and patching vulnerable components promptly.