Security Resilience

CWE · MITRE source

CWE-863Incorrect Authorization

Abstraction: Class · CVEs in our corpus: 4,429

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Last updated: 16 October 2026 12:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 4 mapping(s) from 3 framework(s): STIG oracle linux 8 2 (mostly) · STIG rhel 7 1 (partial) · STIG rhel 8 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • AC-1 Policy and Procedures
  • AC-13 Supervision and Review — Access Control
  • AC-16 Security and Privacy Attributes
  • AC-17 Remote Access
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls PROPOSED for this weakness (43)AI-assisted

These are model PROPOSALS, not graded mappings. They come from controls_to_cwe_proposals, which carries no grade field at all; across the CWE pages 1,540 of 1,722 such associations (89%) have never been graded by anything. The heading said “address” until 2026-09-29, which asserted a relationship the data does not carry. Graded cross-walks are on the framework map, not here.

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
AC-1Policy and ProceduresACPeriodic review and update of procedures reduces incorrect authorization implementations over time.
AC-13Supervision and Review — Access ControlACSupervision identifies cases where authorization logic incorrectly permits unauthorized actions.
AC-16Security and Privacy AttributesACDefining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
SC-14Public Access ProtectionsSCAddresses incorrect policy decisions that would otherwise allow public users to exceed intended privileges.
SC-26DecoysSCDecoys detect incorrect authorization decisions through attacker interactions with deliberately misprotected decoy objects.
SC-43Usage RestrictionsSCOngoing monitoring and control of component usage detects and stops incorrect authorization decisions at runtime.
PM-10Authorization ProcessPMAuthorization reviews within the risk management program detect and prevent incorrect authorization logic or policy enforcement before systems receive approval to operate.
PM-12Insider Threat ProgramPMInsider threat processes catch and remediate incorrect authorization decisions before or after exploitation occurs.
PM-18Privacy Program PlanPMThe plan's coordination, role assignment, and control-description requirements reduce the chance that authorization logic for privacy-relevant resources will be implemented inconsistently or incorrectly.
CA-2Control AssessmentsCAThe assessment evaluates authorization logic and enforcement, identifying incorrect authorization that could be exploited.
CA-4Security CertificationCACertification evaluates whether authorization decisions are correctly implemented and enforced.
CA-6AuthorizationCAThe authorization process includes review of common controls and system security, helping detect and correct incorrect authorization implementations.
PT-2Authority to Process Personally Identifiable InformationPTRestricts processing strictly to documented authorized uses, mitigating incorrect authorization decisions for sensitive data.
PT-4ConsentPTConsent logic ensures authorization decisions governing PII are both present and correctly applied.
PT-8Computer Matching RequirementsPTAddresses incorrect authorization by requiring independent verification of results and an opportunity to contest before any adverse action is taken.
Show 28 more broadly-applicable controls
AC-17Remote AccessACThe authorization process and usage restrictions help prevent incorrect authorization for remote access types.
AC-18Wireless AccessACEstablishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
AC-19Access Control for Mobile DevicesACEstablishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
AC-2Account ManagementACMonitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
AC-20Use of External SystemsACEnsures authorization decisions for external system use are correctly implemented and enforced.
AC-21Information SharingACIt assists users in evaluating and applying correct authorization decisions when sharing information with external partners.
AC-24Access Control DecisionsACApplying decisions to each request prior to enforcement mitigates incorrect authorization by enforcing consistent policy evaluation.
AC-25Reference MonitorACThe small, testable reference monitor reduces the likelihood of incorrect authorization implementations.
AC-3Access EnforcementACMandating policy-based enforcement reduces the chance of incorrect authorization logic being used.
AC-4Information Flow EnforcementACApplies only approved authorizations to information flows, mitigating incorrect authorization decisions.
SC-46Cross Domain Policy EnforcementSCThe mechanism applies correct, centrally managed authorization rules at domain boundaries, blocking incorrect authorization logic from being exploited.
SC-50Software-enforced Separation and Policy EnforcementSCPolicy enforcement mechanisms correct or prevent flawed authorization logic across domain boundaries.
SC-51Hardware-based ProtectionSCEnsures authorization decisions for firmware changes cannot be bypassed by software and must follow explicit re-enable steps.
SC-7Boundary ProtectionSCIncorrect authorization decisions are enforced or detected at external and key internal managed interfaces.
PM-23Data Governance BodyPMDrives review and correction of flawed authorization logic applied to organizational data.
PM-24Data Integrity BoardPMAnnual re-evaluation of active programs detects and corrects cases where authorization rules have become incorrect or overly broad.
PM-29Risk Management Program Leadership RolesPMOrg-wide risk perspective ensures authorization logic is reviewed and corrected rather than implemented inconsistently per system.
CA-9Internal System ConnectionsCAPeriodic review and documentation of connection needs reduces incorrect authorization.
IA-13Identity Providers and Authorization ServersIACentralized authorization servers reduce incorrect authorization by enforcing consistent policies.
IA-4Identifier ManagementIAEnforces correct authorization checks during the identifier assignment process.
MA-5Maintenance PersonnelMAVerifies that non-escorted maintenance personnel possess required access authorizations to avoid incorrect authorization.
MA-7Field MaintenanceMABy defining exactly who may perform field maintenance, the control corrects potential authorization errors for this activity.
PS-1Policy and ProceduresPSPolicy-driven user provisioning and review processes reduce incorrect authorization assignments arising from ad-hoc personnel decisions.
PS-6Access AgreementsPSVerification that individuals have signed current agreements ensures the authorization decision is based on up-to-date, explicitly accepted rules rather than stale or absent approvals.
AU-14Session AuditAUEnables detection of incorrect authorization through review of session-level activities and decisions.
CM-5Access Restrictions for ChangeCMThe control requires correct implementation of authorization specifically tied to change operations.
RA-9Criticality AnalysisRABy surfacing critical resources and functions, the control drives correct authorization logic instead of incorrect authorization decisions.
SI-9Information Input RestrictionsSIReduces incorrect authorization decisions by gating all input at the personnel/process level.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2025-54253 KEV 10.010.00.88262025-08-05
CVE-2019-7192 KEV 9.99.80.88102019-12-05
CVE-2020-13957 9.99.80.79342020-10-13
CVE-2022-46169 KEV 9.99.80.99832022-12-05
CVE-2023-38035 KEV 9.99.80.99952023-08-21
CVE-2023-22518 KEV 9.99.81.00002023-10-31
CVE-2024-38856 KEV 9.99.80.99432024-08-05
CVE-2024-6782 9.99.80.84122024-08-06
CVE-2024-45216 9.99.80.92752024-10-16
CVE-2019-7304 9.69.80.60812019-04-23
CVE-2018-13382 KEV 9.59.10.81692019-06-04
CVE-2021-45466 9.59.80.55342022-12-26
CVE-2025-29927 9.59.10.99222025-03-21
CVE-2026-71362 KEV 9.59.10.87512026-08-11
CVE-2010-2965 9.39.80.47372010-08-05
CVE-2023-35166 9.39.90.62172023-06-20
CVE-2022-0824 9.28.80.96982022-03-02
CVE-2023-34051 9.29.80.44672023-10-20
CVE-2023-26258 9.19.80.39772023-07-03
CVE-2021-3493 KEV 8.88.80.49172021-04-17
CVE-2021-3577 8.88.80.60162021-11-12
CVE-2022-0482 8.79.10.43752022-03-09
CVE-2022-32532 8.79.80.25542022-06-29
CVE-2025-21480 KEV 8.78.60.00462025-06-03
CVE-2025-21479 KEV 8.78.60.00842025-06-03