Source code
Security & compliance
Broken function-level authz: privileged operation with no role check
Part of the Route authorization check · fix arrives as a pull request
What it is
A privileged operation — deleting a record, changing a role, exporting data, altering billing — checks that the caller is authenticated but not that they are permitted to do it.
Why it matters
Authentication is not authorization. Every logged-in user, including the newest free-tier signup, can invoke an operation intended for owners and admins.
How to fix it
Check the specific permission in the handler, not just the presence of a session. Centralise the rules in one policy module so the same question is answered the same way everywhere, and test the denial path.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.