Cyber Resilience

CWE · MITRE source

CWE-863Incorrect Authorization

Abstraction: Class · CVEs in our corpus: 3,578

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Last updated: 22 August 2026 20:22 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: mostly · 4 mapping(s) from 3 framework(s): STIG oracle linux 8 2 (mostly) · STIG rhel 7 1 (partial) · STIG rhel 8 1 (partial)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • AC-1 Policy and Procedures
  • AC-13 Supervision and Review — Access Control
  • AC-16 Security and Privacy Attributes
  • AC-17 Remote Access
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (43)AI-assisted

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
AC-1Policy and ProceduresACPeriodic review and update of procedures reduces incorrect authorization implementations over time.
AC-13Supervision and Review — Access ControlACSupervision identifies cases where authorization logic incorrectly permits unauthorized actions.
AC-16Security and Privacy AttributesACDefining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels.
SC-14Public Access ProtectionsSCAddresses incorrect policy decisions that would otherwise allow public users to exceed intended privileges.
SC-26DecoysSCDecoys detect incorrect authorization decisions through attacker interactions with deliberately misprotected decoy objects.
SC-43Usage RestrictionsSCOngoing monitoring and control of component usage detects and stops incorrect authorization decisions at runtime.
PM-10Authorization ProcessPMAuthorization reviews within the risk management program detect and prevent incorrect authorization logic or policy enforcement before systems receive approval to operate.
PM-12Insider Threat ProgramPMInsider threat processes catch and remediate incorrect authorization decisions before or after exploitation occurs.
PM-18Privacy Program PlanPMThe plan's coordination, role assignment, and control-description requirements reduce the chance that authorization logic for privacy-relevant resources will be implemented inconsistently or incorrectly.
CA-2Control AssessmentsCAThe assessment evaluates authorization logic and enforcement, identifying incorrect authorization that could be exploited.
CA-4Security CertificationCACertification evaluates whether authorization decisions are correctly implemented and enforced.
CA-6AuthorizationCAThe authorization process includes review of common controls and system security, helping detect and correct incorrect authorization implementations.
PT-2Authority to Process Personally Identifiable InformationPTRestricts processing strictly to documented authorized uses, mitigating incorrect authorization decisions for sensitive data.
PT-4ConsentPTConsent logic ensures authorization decisions governing PII are both present and correctly applied.
PT-8Computer Matching RequirementsPTAddresses incorrect authorization by requiring independent verification of results and an opportunity to contest before any adverse action is taken.
Show 28 more broadly-applicable controls
AC-17Remote AccessACThe authorization process and usage restrictions help prevent incorrect authorization for remote access types.
AC-18Wireless AccessACEstablishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access.
AC-19Access Control for Mobile DevicesACEstablishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect.
AC-2Account ManagementACMonitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments.
AC-20Use of External SystemsACEnsures authorization decisions for external system use are correctly implemented and enforced.
AC-21Information SharingACIt assists users in evaluating and applying correct authorization decisions when sharing information with external partners.
AC-24Access Control DecisionsACApplying decisions to each request prior to enforcement mitigates incorrect authorization by enforcing consistent policy evaluation.
AC-25Reference MonitorACThe small, testable reference monitor reduces the likelihood of incorrect authorization implementations.
AC-3Access EnforcementACMandating policy-based enforcement reduces the chance of incorrect authorization logic being used.
AC-4Information Flow EnforcementACApplies only approved authorizations to information flows, mitigating incorrect authorization decisions.
SC-46Cross Domain Policy EnforcementSCThe mechanism applies correct, centrally managed authorization rules at domain boundaries, blocking incorrect authorization logic from being exploited.
SC-50Software-enforced Separation and Policy EnforcementSCPolicy enforcement mechanisms correct or prevent flawed authorization logic across domain boundaries.
SC-51Hardware-based ProtectionSCEnsures authorization decisions for firmware changes cannot be bypassed by software and must follow explicit re-enable steps.
SC-7Boundary ProtectionSCIncorrect authorization decisions are enforced or detected at external and key internal managed interfaces.
PM-23Data Governance BodyPMDrives review and correction of flawed authorization logic applied to organizational data.
PM-24Data Integrity BoardPMAnnual re-evaluation of active programs detects and corrects cases where authorization rules have become incorrect or overly broad.
PM-29Risk Management Program Leadership RolesPMOrg-wide risk perspective ensures authorization logic is reviewed and corrected rather than implemented inconsistently per system.
CA-9Internal System ConnectionsCAPeriodic review and documentation of connection needs reduces incorrect authorization.
IA-13Identity Providers and Authorization ServersIACentralized authorization servers reduce incorrect authorization by enforcing consistent policies.
IA-4Identifier ManagementIAEnforces correct authorization checks during the identifier assignment process.
MA-5Maintenance PersonnelMAVerifies that non-escorted maintenance personnel possess required access authorizations to avoid incorrect authorization.
MA-7Field MaintenanceMABy defining exactly who may perform field maintenance, the control corrects potential authorization errors for this activity.
PS-1Policy and ProceduresPSPolicy-driven user provisioning and review processes reduce incorrect authorization assignments arising from ad-hoc personnel decisions.
PS-6Access AgreementsPSVerification that individuals have signed current agreements ensures the authorization decision is based on up-to-date, explicitly accepted rules rather than stale or absent approvals.
AU-14Session AuditAUEnables detection of incorrect authorization through review of session-level activities and decisions.
CM-5Access Restrictions for ChangeCMThe control requires correct implementation of authorization specifically tied to change operations.
RA-9Criticality AnalysisRABy surfacing critical resources and functions, the control drives correct authorization logic instead of incorrect authorization decisions.
SI-9Information Input RestrictionsSIReduces incorrect authorization decisions by gating all input at the personnel/process level.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2025-54253 KEV 10.010.00.87512025-08-05
CVE-2019-7192 KEV 9.99.80.88212019-12-05
CVE-2020-13957 9.99.80.79342020-10-13
CVE-2022-46169 KEV 9.99.80.99832022-12-05
CVE-2023-38035 KEV 9.99.80.99962023-08-21
CVE-2023-22518 KEV 9.99.81.00002023-10-31
CVE-2024-38856 KEV 9.99.80.99432024-08-05
CVE-2024-6782 9.99.80.84122024-08-06
CVE-2024-45216 9.99.80.90852024-10-16
CVE-2019-7304 9.69.80.61082019-04-23
CVE-2010-2965 9.59.80.57822010-08-05
CVE-2018-13382 KEV 9.59.10.81692019-06-04
CVE-2021-45466 9.59.80.55342022-12-26
CVE-2025-29927 9.59.10.99282025-03-21
CVE-2023-35166 9.39.90.63122023-06-20
CVE-2022-0824 9.28.80.96982022-03-02
CVE-2023-34051 9.29.80.44672023-10-20
CVE-2023-26258 9.09.80.37712023-07-03
CVE-2021-3493 KEV 8.88.80.49172021-04-17
CVE-2021-3577 8.88.80.60162021-11-12
CVE-2022-32532 8.89.80.27162022-06-29
CVE-2022-0482 8.79.10.43752022-03-09
CVE-2025-21480 KEV 8.78.60.00432025-06-03
CVE-2025-21479 KEV 8.78.60.00782025-06-03
CVE-2018-13324 8.69.80.23172018-11-26