CVE-2026-23487: Incorrect Target Role Authorization Bypass
The authorization logic incorrectly checks the role of the requested target (e.g., user record) instead of the current authenticated session context. This can lead to an IDOR (Authorization Bypass) where unprivileged users can access privileged records by requesting them. Ensure that the authorization condition verifies the role of the current requesting use
greprules fetch cve-2026-23487-incorrect-target-role-authorization-bypass --engine opengrepDescription
The authorization logic incorrectly checks the role of the requested target (e.g., user record) instead of the current authenticated session context. This can lead to an IDOR (Authorization Bypass) where unprivileged users can access privileged records by requesting them. Ensure that the authorization condition verifies the role of the current requesting use
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.