Improper authorization is a vulnerability class where a system fails to verify whether a user, service, or request is allowed to perform an action. Instead of enforcing access control on the server side, the application may trust client input, skip role checks on certain routes, or assume that a request coming from a “private” channel is safe. In practice, this can let a low-privilege user reach admin functions, read other users’ data, or change security-critical settings.
This flaw matters because authorization boundaries protect the control plane of a system, not just its data. In cyber attacks, improper authorization often turns a simple API access bug into account takeover, configuration tampering, or even remote code execution if the protected action can influence code, plugins, or deployment state. Defenses include deny-by-default access control, consistent server-side checks on every sensitive endpoint, object-level permissions, and testing with untrusted or low-privilege accounts. Audit logs and route reviews help catch paths that bypass normal policy enforcement.