CWE-841 Improper Enforcement of Behavioral Workflow
What this means
SiteShadow flagged a workflow that can be bypassed or executed out of order. Many security and fraud controls depend on enforcing state transitions ("you must do A before B").
Why it matters
Workflow bypasses can enable privilege escalation or fraud.
- Fraud: skip payment/verification steps and still obtain goods/access.
- Privilege escalation: jump directly to a privileged state ("verified", "approved", "admin") without the checks.
- Security bypass: skip 2FA/email verification/consent steps.
Safer examples
1) Enforce workflow state server-side
Never trust the client to tell you the current state; load it from the database and validate allowed transitions.
2) Use explicit state machines / transition allowlists
Define allowed transitions and reject everything else (see A11 / B01).
3) Make step-up actions idempotent and auditable
Log transitions and include replay protection for one-time steps (verification tokens, approvals).
How SiteShadow detects it (high level)
- Detects client-controlled state flags and direct writes to privileged states.
- Flags endpoints that mutate state without verifying the previous state or required prerequisites.
References
- CWE-841: https://cwe.mitre.org/data/definitions/841.html
---