Cyber Resilience

CWE · MITRE source

CWE-862Missing Authorization

Abstraction: Class · CVEs in our corpus: 8,396

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Last updated: 04 July 2026 00:28 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 11 mapping(s) from 5 framework(s): ATT&CK 5 (partial) · STIG rhel 7 2 (mostly) · STIG oracle linux 8 2 (partial) · OWASP-Web 1 (full) · CAPEC 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

NIST 800-53 r5 controls that address this weakness (57)AI

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
AC-1Policy and ProceduresACRequiring an access control policy ensures authorization checks are defined and applied for critical functions.
AC-13Supervision and Review — Access ControlACReviews of access controls detect missing authorization checks on critical functions or resources.
AC-14Permitted Actions Without Identification or AuthenticationACDocumenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
PM-10Authorization ProcessPMRequiring documented authorization for system operation and critical functions ensures missing authorization controls are identified and corrected during the approval process.
PM-12Insider Threat ProgramPMDedicated team detects missing authorization checks being bypassed by insiders through monitoring and response procedures.
PM-18Privacy Program PlanPMRequiring a documented, approved set of privacy controls and role responsibilities makes omission of authorization checks for functions that handle personal information far less likely.
SC-14Public Access ProtectionsSCForces explicit authorization enforcement before any public request can affect protected data or functions.
SC-15Collaborative Computing Devices and ApplicationsSCEliminates missing authorization checks for activating devices that can capture sensitive information.
SC-26DecoysSCDecoys expose and log missing authorization flaws by serving as monitored targets for unauthorized function access attempts.
CA-2Control AssessmentsCAControl assessments determine if authorization is enforced for functions and resources, detecting missing authorization weaknesses.
CA-4Security CertificationCARequires verification that authorization checks are present and operational for protected resources.
CA-6AuthorizationCAPrevents systems from commencing operations without assigned authorizing official approval, addressing missing authorization for critical functions.
PS-1Policy and ProceduresPSThe required procedures explicitly address authorization checks for personnel actions, lowering the incidence of missing authorization.
PS-6Access AgreementsPSMandating a signed agreement as a prerequisite for access implements a concrete authorization step that would otherwise be missing.
PS-7External Personnel SecurityPSRequires explicit authorization rules and termination notifications for external personnel, preventing missing authorization checks on retained credentials.
Show 42 more broadly-applicable controls
AC-16Security and Privacy AttributesACRequiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
AC-17Remote AccessACMandating authorization prior to allowing remote connections addresses missing authorization for remote access.
AC-18Wireless AccessACMandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
AC-19Access Control for Mobile DevicesACThe control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
AC-2Account ManagementACRequiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.
AC-20Use of External SystemsACMandates authorization checks before permitting access or data processing via external systems.
AC-21Information SharingACThe control provides a mechanism for authorized users to determine authorization matches, preventing sharing without proper authorization verification.
AC-24Access Control DecisionsACRequiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.
AC-25Reference MonitorACAlways invoking the reference monitor prevents missing authorization checks for protected resources.
AC-3Access EnforcementACRequiring enforcement of authorizations ensures checks are performed rather than omitted for resources.
AC-4Information Flow EnforcementACMandates authorization checks and enforcement for all information flows, addressing missing authorization.
PM-21Accounting of DisclosuresPMOrganizations must be able to justify every disclosure, which makes missing authorization for data release both detectable and operationally costly.
PM-23Data Governance BodyPMEnsures missing authorization mechanisms for critical data functions are identified and remediated via policy.
PM-24Data Integrity BoardPMProposal review forces explicit authorization checks for each matching program, preventing execution of matching without required approvals.
PM-27Privacy ReportingPMMonitoring privacy program compliance forces identification of missing authorization checks on personal data resources.
PM-29Risk Management Program Leadership RolesPMLeadership accountability for risk management makes missing authorization controls visible at the enterprise level and subject to remediation.
PM-5System InventoryPMAn authoritative inventory ensures no organizational system is omitted from authorization enforcement checks.
SC-43Usage RestrictionsSCThe control mandates authorization prior to allowing use of designated components, eliminating missing authorization paths.
SC-46Cross Domain Policy EnforcementSCImplementing the enforcement point directly addresses missing authorization checks for operations that cross security domains.
SC-50Software-enforced Separation and Policy EnforcementSCRequires explicit authorization checks as part of the enforced policy between separated components.
SC-51Hardware-based ProtectionSCEliminates missing authorization for writes by requiring physical/hardware action under controlled procedures.
SC-7Boundary ProtectionSCMissing authorization for internal functions is mitigated by requiring all external access to traverse managed boundaries.
CA-9Internal System ConnectionsCARequiring explicit authorization for each internal connection prevents missing authorization.
PS-8Personnel SanctionsPSMakes missing authorization checks or bypasses less likely by sanctioning responsible individuals for policy violations.
PT-1Policy and ProceduresPTRequiring designated ownership and periodic updates ensures authorization checks are defined and maintained for PII operations.
PT-2Authority to Process Personally Identifiable InformationPTRequires explicit determination and documentation of authority before any PII processing occurs, addressing missing authorization.
PT-4ConsentPTThe control supplies the missing authorization check that would otherwise allow processing without user approval.
PT-8Computer Matching RequirementsPTEliminates missing authorization by requiring documented approval and agreements prior to initiating any computer matching program.
MA-2Controlled MaintenanceMAMandating explicit approval for removal of components for off-site maintenance addresses missing authorization for critical maintenance functions.
MA-5Maintenance PersonnelMAMaintains lists of authorized personnel and verifies required access authorizations before allowing maintenance.
MA-7Field MaintenanceMAField maintenance is a critical function; the control supplies the missing authorization step by limiting it to specified entities.
IA-13Identity Providers and Authorization ServersIARequiring authorization servers ensures authorization is performed for protected functions.
IA-4Identifier ManagementIARequires explicit authorization before any identifier can be assigned, preventing missing authorization.
PL-11Baseline TailoringPLTailoring ensures the authorization baseline is scoped and augmented so that missing authorization checks are identified and addressed for the target system.
PL-4Rules of BehaviorPLUsers must acknowledge that access is granted only through proper authorization, directly addressing missing authorization.
RA-7Risk ResponseRAMissing authorization is frequently identified by security assessments; organizational risk-response procedures drive remediation, directly limiting an attacker's ability to invoke protected functionality.
RA-9Criticality AnalysisRACriticality analysis highlights functions that must be protected by authorization checks, mitigating missing authorization on those paths.
SA-14Criticality AnalysisSACriticality analysis reveals functions that must be protected by authorization checks, making missing-authorization weaknesses far less likely to affect high-value operations.
SA-3System Development Life CycleSARequiring security roles and risk processes throughout the SDLC ensures that authorization checks are identified as requirements and implemented for every sensitive operation.
AU-14Session AuditAUSession auditing detects missing authorization by exposing unauthorized actions taken within sessions.
CM-5Access Restrictions for ChangeCMMandating authorization for changes prevents missing authorization checks on critical modification functions.
SI-9Information Input RestrictionsSIPrevents missing authorization checks for input operations by restricting the capability itself.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial).

T1068 Exploitation for Privilege Escalation←P →MT1190 Exploit Public-Facing Application←P →MT1210 Exploitation of Remote Services←P →MT1548 Abuse Elevation Control Mechanism←P →PT1556 Modify Authentication Process←P →P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2021-30657 KEV10.05.50.68532021-09-08
CVE-2021-30713 KEV10.07.80.06582021-09-08
CVE-2021-39226 KEV10.09.80.99892021-10-05
CVE-2021-37976 KEV10.06.50.19902021-10-08
CVE-2022-0543 KEV10.010.00.99672022-02-18
CVE-2022-0492 KEV UPD10.07.80.05532022-03-03
CVE-2024-57726 KEV10.09.90.09332025-01-15
CVE-2023-52163 KEV10.08.80.96432025-02-03
CVE-2025-6205 KEV UPD10.09.10.69172025-08-04
CVE-2025-20362 KEV10.06.50.85542025-09-25
CVE-2025-40602 KEV10.06.60.01912025-12-18
CVE-2017-66228.09.80.62172017-05-18
CVE-2018-60008.09.80.84202018-01-22
CVE-2018-100938.08.80.68682019-03-21
CVE-2019-112488.08.20.61142019-08-29
CVE-2019-159548.09.90.79202019-09-05
CVE-2019-199858.05.30.71402019-12-26
CVE-2020-87728.09.80.87872020-02-06
CVE-2021-213078.08.60.89192021-02-11
CVE-2021-219788.09.80.99002021-03-03
CVE-2021-321728.09.80.66432021-10-07
CVE-2022-239448.09.10.79012022-01-25
CVE-2022-02188.08.30.70512022-02-04
CVE-2022-236428.08.80.74312022-02-18
CVE-2022-13298.08.80.92942022-04-19