Common Weakness Enumeration

    CWE Definition / CWE-647

    CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions

    The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.

    Published:30 Jan 2008
    Organization:MITRE
    Modified:11 Dec 2025

    Related Weakness

    CWE-863: Incorrect Authorization

    CWE-180: Incorrect Behavior Order: Validate Before Canonicalize