Mobile apps may perform authorization checks client-side that can be bypassed through reverse engineering or tampering. Insecure authorization allows users to access other users' data, perform privileged actions, or bypass business logic constraints. Server-side enforcement is essential.
Enforce authorization checks on both client and server side. Never trust client-side authorization alone. Implement proper role-based access control and validate permissions for every sensitive operation. Use server-side session management with proper token validation.
The same feature written the risky way, then with the fix applied.
How this risk has ranked in each OWASP release.
Rank by release (taller is higher)
2024Latest
#06mobile06-2024 Inadequate Privacy Controls
No change since 20162016
#06Insecure Authorization
