Missing Authorization (ARCH4120)

Key java.security.missing-authorization · Severity warning · Category security · CWE CWE-862

A controller endpoint that exposes a sensitive action without an authorization check lets any client invoke the protected operation. Guard sensitive endpoints with an explicit authorization check.

Incorrect

@DeleteMapping("/admin/users/{id}")
void delete(@PathVariable Long id) { // no authorization check
    userService.delete(id);
}

Correct

@DeleteMapping("/admin/users/{id}")
@PreAuthorize("hasRole('ADMIN')")
void delete(@PathVariable Long id) {
    userService.delete(id);
}

Fix

Add an authorization guard such as @PreAuthorize to sensitive endpoints.