An authorization weakness is a flaw in how software decides whether a user or process is allowed to perform an action. Authentication answers “who are you?”; authorization answers “what may you do?” If that second check is broken, a lower-privilege account, app component, or device context may access functions meant for a more trusted role.
This matters because access control failures can expose data, change settings, or trigger privileged operations without any password being stolen. In real attacks, authorization bugs often support privilege escalation, lateral movement, or unauthorized configuration changes. Defenders look for missing role checks, insecure direct object references, and API endpoints that trust client-supplied parameters too much. Good fixes include server-side permission checks, least privilege, and testing every sensitive action from multiple user roles, not just the normal admin path.