CWE · MITRE source
CWE-807Reliance on Untrusted Inputs in a Security Decision
The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
Developers may assume that inputs such as cookies, environment variables, and hidden form fields cannot be modified. However, an attacker could change these inputs using customized clients or other attacks. This change might not be detected. When security decisions such as authentication and authorization are made based on the values of these inputs, attackers can bypass the security of the software. Without sufficient encryption, integrity checking, or other mechanism, any input that originates from an outsider cannot be trusted.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: mostly · 4 mapping(s) from 2 framework(s): ATT&CK 3 (partial) · OWASP-Web 1 (mostly)
OWASP Top 10 for Web (2025)
This weakness contributes to A06:2025 Insecure Design.
NIST 800-53 r5 controls that address this weakness (3)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
PT-8 | Computer Matching Requirements | PT | Prevents reliance on untrusted matching results for security-relevant decisions by enforcing verification and contest procedures. |
SC-16 | Transmission of Security and Privacy Attributes | SC | Providing authoritative attributes with the data reduces the need for security decisions to rely on untrusted external inputs. |
SI-9 | Information Input Restrictions | SI | Reduces reliance on untrusted inputs by ensuring only authorized sources may supply data. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2026-21509 KEV UPD | 10.0 | 7.8 | 0.7215 | 2026-01-26 |
CVE-2026-21514 KEV | 10.0 | 7.8 | 0.0152 | 2026-02-10 |
CVE-2023-45128 | 7.0 | 10.0 | 0.0031 | 2023-10-16 |
CVE-2024-29039 | 7.0 | 9.0 | 0.0098 | 2024-06-28 |
CVE-2025-1126 | 7.0 | 9.3 | 0.0025 | 2025-02-11 |
CVE-2025-49827 UPD | 7.0 | 9.8 | 0.0140 | 2025-07-15 |
CVE-2025-12487 | 7.0 | 9.8 | 0.0078 | 2025-11-06 |
CVE-2025-12488 | 7.0 | 9.8 | 0.0078 | 2025-11-06 |
CVE-2025-66570 | 7.0 | 10.0 | 0.0030 | 2025-12-05 |
CVE-2026-32975 | 7.0 | 9.8 | 0.0034 | 2026-03-29 |
CVE-2025-13926 | 7.0 | 9.8 | 0.0044 | 2026-04-09 |
CVE-2026-24120 UPD | 7.0 | 9.8 | 0.0090 | 2026-05-04 |
CVE-2026-44649 UPD | 7.0 | 9.8 | 0.0022 | 2026-05-29 |
CVE-2026-48491 | 7.0 | 10.0 | 0.0024 | 2026-06-23 |
CVE-2026-34486 UPD | 6.0 | 7.5 | 0.1583 | 2026-04-09 |
CVE-2021-29479 | 5.5 | 7.0 | 0.0086 | 2021-06-29 |
CVE-2021-31999 | 5.5 | 8.8 | 0.0105 | 2021-07-15 |
CVE-2021-41129 | 5.5 | 8.1 | 0.0170 | 2021-10-06 |
CVE-2021-36777 | 5.5 | 8.1 | 0.0089 | 2022-03-09 |
CVE-2023-0009 | 5.5 | 7.8 | 0.0018 | 2023-06-14 |
CVE-2022-24400 | 5.5 | 7.5 | 0.0027 | 2023-10-19 |
CVE-2024-28824 UPD | 5.5 | 8.8 | 0.0018 | 2024-03-22 |
CVE-2024-28829 | 5.5 | 7.8 | 0.0018 | 2024-08-20 |
CVE-2024-5754 | 5.5 | 8.2 | 0.0031 | 2024-09-13 |
CVE-2024-51561 | 5.5 | 7.5 | 0.0052 | 2024-11-04 |