--- title: 7 Common Authorization Vulnerabilities | daily.dev description: Common authorization vulnerabilities in web and desktop applications are explained through a hypothetical social networking app example, covering insecure... canonical: https://daily.dev/posts/7-common-authorization-vulnerabilities-nstvzznrd twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: 7 Common Authorization Vulnerabilities | daily.dev og:description: Common authorization vulnerabilities in web and desktop applications are explained through a hypothetical social networking app example, covering insecure... og:url: https://daily.dev/posts/7-common-authorization-vulnerabilities-nstvzznrd og:image: https://api.daily.dev/og/posts/nSTvzzNRD.png og:image:alt: 7 Common Authorization Vulnerabilities og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 7 Common Authorization Vulnerabilities **[Teleport](https://daily.dev/sources/teleport)** · 9 min read · 0 upvotes · 0 comments ## Summary Common authorization vulnerabilities in web and desktop applications are explained through a hypothetical social networking app example, covering insecure direct object reference (IDOR), unprotected resources, client-side authorization state tampering, directory traversal, misconfigured access policies (e.g., overly permissive AWS IAM roles, CORS misconfigurations), bypassable policies (location/user-agent based), and privilege escalation via binary exploits like Dirty Pipe (CVE-2022-0847) and PwnKit. The piece closes with a pitch for Teleport's privileged access management platform to mitigate insider threats. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is an insecure direct object reference (IDOR) vulnerability? An IDOR vulnerability occurs when an application checks that a user has a general privilege, such as the ability to delete pictures, but fails to verify that the specific resource belongs to that user. For example, a user allowed to delete their own pictures could change an id parameter in a delete request, like changing id=2 to id=6, and delete another user's picture instead. _Developers hardening APIs against IDOR track authorization writeups like this on daily.dev._ ### What is the Dirty Pipe vulnerability CVE-2022-0847? CVE-2022-0847, known as Dirty Pipe, is a Linux privilege escalation vulnerability that allows a normal user or process to overwrite data in arbitrary files, including files owned by root, enabling escalation to root-level access. It is one of several binary exploitation flaws, alongside PwnKit, that attackers use to bypass operating system level authorization. _Security engineers tracking Linux privilege escalation CVEs can follow research like this on daily.dev._ ### Why is storing user roles like role=admin in a client-side cookie insecure? Storing authorization state such as role=admin in a client-side session cookie is insecure because it can be tampered with using an intercepting proxy like OWASP ZAP, Burp Suite, or mitmproxy, even when the cookie is marked HttpOnly. This applies to web and desktop apps alike, since desktop client-server traffic can also be intercepted, so authorization state must always be verified server-side. _Teams designing session and role management can compare authorization patterns like this on daily.dev._ ## Similar posts on daily.dev - [OSSEC: IDOR vulnerability no more — The easiest way for you to verify your apps yourself.](https://daily.dev/posts/ossec-idor-vulnerability-no-more-the-easiest-way-for-you-to-verify-your-apps-yourself--im32nx5sz) · ITNEXT · 1 upvotes · 0 comments - [How to Fix Common Web Application Security Vulnerabilities in Node.js](https://daily.dev/posts/how-to-fix-common-web-application-security-vulnerabilities-in-node-js-nhhyrhesv) · freeCodeCamp · 3 upvotes · 0 comments - [Build an IDOR Vulnerability Lab: Why WHERE Clauses Don’t Protect Your API.](https://daily.dev/posts/build-an-idor-vulnerability-lab-why-where-clauses-don-t-protect-your-api--wmreqolv5) · InfoSec Write-ups · 0 upvotes · 0 comments - [IDOR Attacks and the Growing Threat to Your API Security – FireTail Blog](https://daily.dev/posts/idor-attacks-and-the-growing-threat-to-your-api-security-firetail-blog-j3qbtauze) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#authorization](https://daily.dev/tags/authorization), [#web-security](https://daily.dev/tags/web-security) [View this post on daily.dev](https://daily.dev/posts/7-common-authorization-vulnerabilities-nstvzznrd) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"7 Common Authorization Vulnerabilities","url":"https://daily.dev/posts/7-common-authorization-vulnerabilities-nstvzznrd","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/7-common-authorization-vulnerabilities-nstvzznrd"},"datePublished":"2026-08-23T12:19:12.428Z","dateModified":"2026-08-23T12:35:55.188Z","description":"Common authorization vulnerabilities in web and desktop applications are explained through a hypothetical social networking app example, covering insecure...","image":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","thumbnailUrl":"https://media.daily.dev/image/upload/s--P4t4XyoV--/f_auto/v1722860399/public/Placeholder%2001","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/7-common-authorization-vulnerabilities-nstvzznrd","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authorization,web-security","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"7 Common Authorization Vulnerabilities"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/7-common-authorization-vulnerabilities-nstvzznrd#faq","mainEntity":[{"@type":"Question","name":"What is an insecure direct object reference (IDOR) vulnerability?","acceptedAnswer":{"@type":"Answer","text":"An IDOR vulnerability occurs when an application checks that a user has a general privilege, such as the ability to delete pictures, but fails to verify that the specific resource belongs to that user. For example, a user allowed to delete their own pictures could change an id parameter in a delete request, like changing id=2 to id=6, and delete another user's picture instead. Developers hardening APIs against IDOR track authorization writeups like this on daily.dev."}},{"@type":"Question","name":"What is the Dirty Pipe vulnerability CVE-2022-0847?","acceptedAnswer":{"@type":"Answer","text":"CVE-2022-0847, known as Dirty Pipe, is a Linux privilege escalation vulnerability that allows a normal user or process to overwrite data in arbitrary files, including files owned by root, enabling escalation to root-level access. It is one of several binary exploitation flaws, alongside PwnKit, that attackers use to bypass operating system level authorization. Security engineers tracking Linux privilege escalation CVEs can follow research like this on daily.dev."}},{"@type":"Question","name":"Why is storing user roles like role=admin in a client-side cookie insecure?","acceptedAnswer":{"@type":"Answer","text":"Storing authorization state such as role=admin in a client-side session cookie is insecure because it can be tampered with using an intercepting proxy like OWASP ZAP, Burp Suite, or mitmproxy, even when the cookie is marked HttpOnly. This applies to web and desktop apps alike, since desktop client-server traffic can also be intercepted, so authorization state must always be verified server-side. Teams designing session and role management can compare authorization patterns like this on daily.dev."}}]} ```