Security Resilience

CWE · MITRE source

CWE-862Missing Authorization

Abstraction: Class · CVEs in our corpus: 10,858

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Last updated: 16 October 2026 10:19 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 4 mapping(s) from 2 framework(s): STIG rhel 7 2 (mostly) · STIG oracle linux 8 2 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • AC-1 Policy and Procedures
  • AC-13 Supervision and Review — Access Control
  • AC-14 Permitted Actions Without Identification or Authentication
  • AC-16 Security and Privacy Attributes
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (57)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
AC-1Policy and ProceduresACRequiring an access control policy ensures authorization checks are defined and applied for critical functions.
AC-13Supervision and Review — Access ControlACReviews of access controls detect missing authorization checks on critical functions or resources.
AC-14Permitted Actions Without Identification or AuthenticationACDocumenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
PM-10Authorization ProcessPMRequiring documented authorization for system operation and critical functions ensures missing authorization controls are identified and corrected during the approval process.
PM-12Insider Threat ProgramPMDedicated team detects missing authorization checks being bypassed by insiders through monitoring and response procedures.
PM-18Privacy Program PlanPMRequiring a documented, approved set of privacy controls and role responsibilities makes omission of authorization checks for functions that handle personal information far less likely.
SC-14Public Access ProtectionsSCForces explicit authorization enforcement before any public request can affect protected data or functions.
SC-15Collaborative Computing Devices and ApplicationsSCEliminates missing authorization checks for activating devices that can capture sensitive information.
SC-26DecoysSCDecoys expose and log missing authorization flaws by serving as monitored targets for unauthorized function access attempts.
CA-2Control AssessmentsCAControl assessments determine if authorization is enforced for functions and resources, detecting missing authorization weaknesses.
CA-4Security CertificationCARequires verification that authorization checks are present and operational for protected resources.
CA-6AuthorizationCAPrevents systems from commencing operations without assigned authorizing official approval, addressing missing authorization for critical functions.
PS-1Policy and ProceduresPSThe required procedures explicitly address authorization checks for personnel actions, lowering the incidence of missing authorization.
PS-6Access AgreementsPSMandating a signed agreement as a prerequisite for access implements a concrete authorization step that would otherwise be missing.
PS-7External Personnel SecurityPSRequires explicit authorization rules and termination notifications for external personnel, preventing missing authorization checks on retained credentials.
Show 42 more broadly-applicable controls
AC-16Security and Privacy AttributesACRequiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
AC-17Remote AccessACMandating authorization prior to allowing remote connections addresses missing authorization for remote access.
AC-18Wireless AccessACMandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
AC-19Access Control for Mobile DevicesACThe control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
AC-2Account ManagementACRequiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.
AC-20Use of External SystemsACMandates authorization checks before permitting access or data processing via external systems.
AC-21Information SharingACThe control provides a mechanism for authorized users to determine authorization matches, preventing sharing without proper authorization verification.
AC-24Access Control DecisionsACRequiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.
AC-25Reference MonitorACAlways invoking the reference monitor prevents missing authorization checks for protected resources.
AC-3Access EnforcementACRequiring enforcement of authorizations ensures checks are performed rather than omitted for resources.
AC-4Information Flow EnforcementACMandates authorization checks and enforcement for all information flows, addressing missing authorization.
PM-21Accounting of DisclosuresPMOrganizations must be able to justify every disclosure, which makes missing authorization for data release both detectable and operationally costly.
PM-23Data Governance BodyPMEnsures missing authorization mechanisms for critical data functions are identified and remediated via policy.
PM-24Data Integrity BoardPMProposal review forces explicit authorization checks for each matching program, preventing execution of matching without required approvals.
PM-27Privacy ReportingPMMonitoring privacy program compliance forces identification of missing authorization checks on personal data resources.
PM-29Risk Management Program Leadership RolesPMLeadership accountability for risk management makes missing authorization controls visible at the enterprise level and subject to remediation.
PM-5System InventoryPMAn authoritative inventory ensures no organizational system is omitted from authorization enforcement checks.
SC-43Usage RestrictionsSCThe control mandates authorization prior to allowing use of designated components, eliminating missing authorization paths.
SC-46Cross Domain Policy EnforcementSCImplementing the enforcement point directly addresses missing authorization checks for operations that cross security domains.
SC-50Software-enforced Separation and Policy EnforcementSCRequires explicit authorization checks as part of the enforced policy between separated components.
SC-51Hardware-based ProtectionSCEliminates missing authorization for writes by requiring physical/hardware action under controlled procedures.
SC-7Boundary ProtectionSCMissing authorization for internal functions is mitigated by requiring all external access to traverse managed boundaries.
CA-9Internal System ConnectionsCARequiring explicit authorization for each internal connection prevents missing authorization.
PS-8Personnel SanctionsPSMakes missing authorization checks or bypasses less likely by sanctioning responsible individuals for policy violations.
PT-1Policy and ProceduresPTRequiring designated ownership and periodic updates ensures authorization checks are defined and maintained for PII operations.
PT-2Authority to Process Personally Identifiable InformationPTRequires explicit determination and documentation of authority before any PII processing occurs, addressing missing authorization.
PT-4ConsentPTThe control supplies the missing authorization check that would otherwise allow processing without user approval.
PT-8Computer Matching RequirementsPTEliminates missing authorization by requiring documented approval and agreements prior to initiating any computer matching program.
MA-2Controlled MaintenanceMAMandating explicit approval for removal of components for off-site maintenance addresses missing authorization for critical maintenance functions.
MA-5Maintenance PersonnelMAMaintains lists of authorized personnel and verifies required access authorizations before allowing maintenance.
MA-7Field MaintenanceMAField maintenance is a critical function; the control supplies the missing authorization step by limiting it to specified entities.
IA-13Identity Providers and Authorization ServersIARequiring authorization servers ensures authorization is performed for protected functions.
IA-4Identifier ManagementIARequires explicit authorization before any identifier can be assigned, preventing missing authorization.
PL-11Baseline TailoringPLTailoring ensures the authorization baseline is scoped and augmented so that missing authorization checks are identified and addressed for the target system.
PL-4Rules of BehaviorPLUsers must acknowledge that access is granted only through proper authorization, directly addressing missing authorization.
RA-7Risk ResponseRAMissing authorization is frequently identified by security assessments; organizational risk-response procedures drive remediation, directly limiting an attacker's ability to invoke protected functionality.
RA-9Criticality AnalysisRACriticality analysis highlights functions that must be protected by authorization checks, mitigating missing authorization on those paths.
SA-14Criticality AnalysisSACriticality analysis reveals functions that must be protected by authorization checks, making missing-authorization weaknesses far less likely to affect high-value operations.
SA-3System Development Life CycleSARequiring security roles and risk processes throughout the SDLC ensures that authorization checks are identified as requirements and implemented for every sensitive operation.
AU-14Session AuditAUSession auditing detects missing authorization by exposing unauthorized actions taken within sessions.
CM-5Access Restrictions for ChangeCMMandating authorization for changes prevents missing authorization checks on critical modification functions.
SI-9Information Input RestrictionsSIPrevents missing authorization checks for input operations by restricting the capability itself.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-0543 KEV 10.010.00.99352022-02-18
CVE-2018-6000 9.99.80.85162018-01-22
CVE-2020-8772 9.99.80.88052020-02-06
CVE-2021-21978 9.99.80.99002021-03-03
CVE-2021-39226 KEV 9.99.80.99932021-10-05
CVE-2023-6875 9.99.80.90342024-01-11
CVE-2024-41730 9.99.80.75872024-08-13
CVE-2025-8943 9.99.80.75202025-08-14
CVE-2021-45467 9.89.80.70752022-12-26
CVE-2021-32172 9.79.80.66432021-10-07
CVE-2017-6622 9.69.80.62172017-05-18
CVE-2024-57726 KEV 9.69.90.66602025-01-15
CVE-2025-11833 9.69.80.61482025-11-01
CVE-2026-84869 KEV9.69.90.00922026-09-08
CVE-2019-15954 9.59.90.78692019-09-05
CVE-2024-31997 9.59.90.73922024-04-10
CVE-2025-6205 KEV 9.59.10.73752025-08-04
CVE-2018-1217 9.49.80.50872018-04-09
CVE-2022-23944 9.49.10.79012022-01-25
CVE-2025-5394 9.49.80.53462025-07-15
CVE-2017-9232 9.39.80.48502017-05-28
CVE-2020-36239 9.39.80.49822021-07-29
CVE-2022-1329 9.28.80.92662022-04-19
CVE-2023-52163 KEV 9.28.80.96922025-02-03
CVE-2022-23642 9.18.80.74312022-02-18