Weak authorization is a control failure where a system checks access too loosely, inconsistently, or only after a request has already reached a sensitive operation. In practice, the application may verify that a user is logged in, but fail to confirm that the user is allowed to perform that specific action on that specific object or feature.
In cyber security, weak authorization is dangerous because it can let an attacker turn a normal account into a more powerful one. Common outcomes include privilege escalation, unauthorized data access, and administrative action abuse in web apps, APIs, and enterprise platforms. Defenders look for this by testing object-level and function-level access controls, validating role checks on the server side, and confirming that every action is enforced by explicit authorization logic rather than by UI restrictions or assumptions about trust. Strong authorization uses least privilege, deny-by-default rules, and repeated verification of the user’s rights before each sensitive operation.