Missing authorization (ARCH2120)

Key python.security.missing-authorization · Severity warning · Category security · CWE CWE-862

Exposing a sensitive action without an authorization guard lets any user invoke operations that should be protected. Every sensitive endpoint must explicitly check access.

Incorrect

@app.route("/admin/users/<int:uid>", methods=["DELETE"])
def delete_user(uid):
    User.query.filter_by(id=uid).delete()
    return "", 204

Correct

@app.route("/admin/users/<int:uid>", methods=["DELETE"])
@login_required
@admin_required
def delete_user(uid):
    User.query.filter_by(id=uid).delete()
    return "", 204

Fix

Add explicit authentication and authorization guards to state-changing and sensitive endpoints.