Glossary

Business logic flaw

A weakness in an application’s rules rather than in how it parses input, such as skipping a workflow step, reusing a one-time coupon or ordering a negative quantity, so valid-looking requests reach an outcome the business never intended (CWE-840).

Also called: logic flaw · business logic vulnerability
Defined in: MITRE CWE-840
Identifiers: CWE-840

Covered in

Guide

Prevent business-logic flaws with server-side invariants

Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.

Practice: Business logic lab: Price an order without trusting the client