# V5328\. OWASP\. Using non\-restrictive authorization checks could lead to security violations\.

The analyzer has detected a potential error related to weak user authorization verification\. Granting unrestricted access to all users may lead to security vulnerabilities and unauthorized use of critical program features\.

This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows: 

* [A1:2021 \- Broken Access Control](https://owasp.org/Top10/A01_2021-Broken_Access_Control/)

When verifying authorization, the decision\-making method may deny authorization if users lack the required privileges\. If the method implementation does not enforce access denial, it is insecure, making authorization verification unreliable\.

For example, the `vote` method of the [`AccessDecisionVoter`](https://docs.spring.io/spring-security/site/docs/4.2.x/apidocs/org/springframework/security/access/AccessDecisionVoter.html) class always returns a positive response, even if users lack the required privileges:

```cpp
@Override
public int vote(Authentication authentication, 
                FilterInvocation filterInvocation, 
                Collection<ConfigAttribute> attributes
  ) {
  boolean isAdmin = hasAdminRole(authentication);
  String requestMethod = filterInvocation.getRequest().getMethod();
  if ("DELETE".equals(requestMethod) && !isAdmin) {
    return ACCESS_GRANTED;
  }
  return ACCESS_GRANTED;
}
```

Secure implementation should return at least one negative response:

```cpp
@Override
public int vote(Authentication authentication, 
                FilterInvocation filterInvocation, 
                Collection<ConfigAttribute> attributes
  ) {
  boolean isAdmin = hasAdminRole(authentication);
  String requestMethod = filterInvocation.getRequest().getMethod();
  if ("DELETE".equals(requestMethod) && !isAdmin) {
    return ACCESS_DENIED;
  }
  return ACCESS_GRANTED;
}
```