CWE · MITRE source
CWE-863Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Last updated: 04 July 2026 00:28 UTC
Cumulative inbound coverage
How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.
Collective: full · 13 mapping(s) from 5 framework(s): ATT&CK 8 (mostly) · STIG oracle linux 8 2 (mostly) · OWASP-Web 1 (full) · STIG rhel 7 1 (partial) · STIG rhel 8 1 (partial)
OWASP Top 10 for Web (2025)
This weakness contributes to A01:2025 Broken Access Control.
NIST 800-53 r5 controls that address this weakness (43)AI
Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
AC-1 | Policy and Procedures | AC | Periodic review and update of procedures reduces incorrect authorization implementations over time. |
AC-13 | Supervision and Review — Access Control | AC | Supervision identifies cases where authorization logic incorrectly permits unauthorized actions. |
AC-16 | Security and Privacy Attributes | AC | Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels. |
SC-14 | Public Access Protections | SC | Addresses incorrect policy decisions that would otherwise allow public users to exceed intended privileges. |
SC-26 | Decoys | SC | Decoys detect incorrect authorization decisions through attacker interactions with deliberately misprotected decoy objects. |
SC-43 | Usage Restrictions | SC | Ongoing monitoring and control of component usage detects and stops incorrect authorization decisions at runtime. |
PM-10 | Authorization Process | PM | Authorization reviews within the risk management program detect and prevent incorrect authorization logic or policy enforcement before systems receive approval to operate. |
PM-12 | Insider Threat Program | PM | Insider threat processes catch and remediate incorrect authorization decisions before or after exploitation occurs. |
PM-18 | Privacy Program Plan | PM | The plan's coordination, role assignment, and control-description requirements reduce the chance that authorization logic for privacy-relevant resources will be implemented inconsistently or incorrectly. |
CA-2 | Control Assessments | CA | The assessment evaluates authorization logic and enforcement, identifying incorrect authorization that could be exploited. |
CA-4 | Security Certification | CA | Certification evaluates whether authorization decisions are correctly implemented and enforced. |
CA-6 | Authorization | CA | The authorization process includes review of common controls and system security, helping detect and correct incorrect authorization implementations. |
PT-2 | Authority to Process Personally Identifiable Information | PT | Restricts processing strictly to documented authorized uses, mitigating incorrect authorization decisions for sensitive data. |
PT-4 | Consent | PT | Consent logic ensures authorization decisions governing PII are both present and correctly applied. |
PT-8 | Computer Matching Requirements | PT | Addresses incorrect authorization by requiring independent verification of results and an opportunity to contest before any adverse action is taken. |
Show 28 more broadly-applicable controls
AC-17 | Remote Access | AC | The authorization process and usage restrictions help prevent incorrect authorization for remote access types. |
AC-18 | Wireless Access | AC | Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access. |
AC-19 | Access Control for Mobile Devices | AC | Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect. |
AC-2 | Account Management | AC | Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments. |
AC-20 | Use of External Systems | AC | Ensures authorization decisions for external system use are correctly implemented and enforced. |
AC-21 | Information Sharing | AC | It assists users in evaluating and applying correct authorization decisions when sharing information with external partners. |
AC-24 | Access Control Decisions | AC | Applying decisions to each request prior to enforcement mitigates incorrect authorization by enforcing consistent policy evaluation. |
AC-25 | Reference Monitor | AC | The small, testable reference monitor reduces the likelihood of incorrect authorization implementations. |
AC-3 | Access Enforcement | AC | Mandating policy-based enforcement reduces the chance of incorrect authorization logic being used. |
AC-4 | Information Flow Enforcement | AC | Applies only approved authorizations to information flows, mitigating incorrect authorization decisions. |
SC-46 | Cross Domain Policy Enforcement | SC | The mechanism applies correct, centrally managed authorization rules at domain boundaries, blocking incorrect authorization logic from being exploited. |
SC-50 | Software-enforced Separation and Policy Enforcement | SC | Policy enforcement mechanisms correct or prevent flawed authorization logic across domain boundaries. |
SC-51 | Hardware-based Protection | SC | Ensures authorization decisions for firmware changes cannot be bypassed by software and must follow explicit re-enable steps. |
SC-7 | Boundary Protection | SC | Incorrect authorization decisions are enforced or detected at external and key internal managed interfaces. |
PM-23 | Data Governance Body | PM | Drives review and correction of flawed authorization logic applied to organizational data. |
PM-24 | Data Integrity Board | PM | Annual re-evaluation of active programs detects and corrects cases where authorization rules have become incorrect or overly broad. |
PM-29 | Risk Management Program Leadership Roles | PM | Org-wide risk perspective ensures authorization logic is reviewed and corrected rather than implemented inconsistently per system. |
CA-9 | Internal System Connections | CA | Periodic review and documentation of connection needs reduces incorrect authorization. |
IA-13 | Identity Providers and Authorization Servers | IA | Centralized authorization servers reduce incorrect authorization by enforcing consistent policies. |
IA-4 | Identifier Management | IA | Enforces correct authorization checks during the identifier assignment process. |
MA-5 | Maintenance Personnel | MA | Verifies that non-escorted maintenance personnel possess required access authorizations to avoid incorrect authorization. |
MA-7 | Field Maintenance | MA | By defining exactly who may perform field maintenance, the control corrects potential authorization errors for this activity. |
PS-1 | Policy and Procedures | PS | Policy-driven user provisioning and review processes reduce incorrect authorization assignments arising from ad-hoc personnel decisions. |
PS-6 | Access Agreements | PS | Verification that individuals have signed current agreements ensures the authorization decision is based on up-to-date, explicitly accepted rules rather than stale or absent approvals. |
AU-14 | Session Audit | AU | Enables detection of incorrect authorization through review of session-level activities and decisions. |
CM-5 | Access Restrictions for Change | CM | The control requires correct implementation of authorization specifically tied to change operations. |
RA-9 | Criticality Analysis | RA | By surfacing critical resources and functions, the control drives correct authorization logic instead of incorrect authorization decisions. |
SI-9 | Information Input Restrictions | SI | Reduces incorrect authorization decisions by gating all input at the personnel/process level. |
MITRE ATT&CK techniques this weakness enables
Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing). Drafted by Grok and spot-checked by Claude Opus 4.8.
Direction: ← other covers this;
→ this covers other (F/M/P = full / mostly /
partial).
T1068 Exploitation for Privilege Escalation←P →MT1190 Exploit Public-Facing Application←P →PT1210 Exploitation of Remote Services←P →PT1548 Abuse Elevation Control Mechanism←P →MT1548.002 Bypass User Account Control←M →MT1548.003 Sudo and Sudo Caching←M →MT1548.004 Elevated Execution with Prompt←P →PT1548.006 TCC Manipulation←P →P
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2018-13382 KEV | 10.0 | 9.1 | 0.8169 | 2019-06-04 |
CVE-2019-7192 KEV | 10.0 | 9.8 | 0.8821 | 2019-12-05 |
CVE-2021-3493 KEV | 10.0 | 8.8 | 0.4399 | 2021-04-17 |
CVE-2021-30533 KEV | 10.0 | 6.5 | 0.1661 | 2021-06-07 |
CVE-2021-40655 KEV | 10.0 | 7.5 | 0.8704 | 2021-09-24 |
CVE-2021-3560 KEV | 10.0 | 7.8 | 0.2219 | 2022-02-16 |
CVE-2022-41091 KEV | 10.0 | 5.4 | 0.0199 | 2022-11-09 |
CVE-2022-46169 KEV | 10.0 | 9.8 | 0.9983 | 2022-12-05 |
CVE-2023-21715 KEV | 10.0 | 7.3 | 0.1211 | 2023-02-14 |
CVE-2023-24880 KEV | 10.0 | 4.4 | 0.7815 | 2023-03-14 |
CVE-2023-38035 KEV | 10.0 | 9.8 | 0.9995 | 2023-08-21 |
CVE-2023-20269 KEV | 10.0 | 5.0 | 0.2158 | 2023-09-06 |
CVE-2023-22518 KEV | 10.0 | 9.8 | 1.0000 | 2023-10-31 |
CVE-2024-38856 KEV | 10.0 | 9.8 | 0.9943 | 2024-08-05 |
CVE-2024-21287 KEV | 10.0 | 7.5 | 0.0150 | 2024-11-18 |
CVE-2025-24200 KEV | 10.0 | 6.1 | 0.0491 | 2025-02-10 |
CVE-2025-21480 KEV UPD | 10.0 | 8.6 | 0.0036 | 2025-06-03 |
CVE-2025-21479 KEV UPD | 10.0 | 8.6 | 0.0066 | 2025-06-03 |
CVE-2025-54253 KEV UPD | 10.0 | 10.0 | 0.8982 | 2025-08-05 |
CVE-2025-55177 KEV UPD | 10.0 | 5.4 | 0.0412 | 2025-08-29 |
CVE-2010-2965 | 8.0 | 9.8 | 0.5754 | 2010-08-05 |
CVE-2019-7304 | 8.0 | 9.8 | 0.6108 | 2019-04-23 |
CVE-2019-3403 | 8.0 | 5.3 | 0.5264 | 2019-05-22 |
CVE-2020-13957 | 8.0 | 9.8 | 0.7887 | 2020-10-13 |
CVE-2020-36289 | 8.0 | 5.3 | 0.9921 | 2021-05-12 |