Cyber Posture

CWE · MITRE source

CWE-862Missing Authorization

Abstraction: Class · CVEs in our corpus: 7,737

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (57)AI

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
AC-1Policy and ProceduresACRequiring an access control policy ensures authorization checks are defined and applied for critical functions.
AC-13Supervision and Review — Access ControlACReviews of access controls detect missing authorization checks on critical functions or resources.
AC-14Permitted Actions Without Identification or AuthenticationACDocumenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.
PM-10Authorization ProcessPMRequiring documented authorization for system operation and critical functions ensures missing authorization controls are identified and corrected during the approval process.
PM-12Insider Threat ProgramPMDedicated team detects missing authorization checks being bypassed by insiders through monitoring and response procedures.
PM-18Privacy Program PlanPMRequiring a documented, approved set of privacy controls and role responsibilities makes omission of authorization checks for functions that handle personal information far less likely.
SC-14Public Access ProtectionsSCForces explicit authorization enforcement before any public request can affect protected data or functions.
SC-15Collaborative Computing Devices and ApplicationsSCEliminates missing authorization checks for activating devices that can capture sensitive information.
SC-26DecoysSCDecoys expose and log missing authorization flaws by serving as monitored targets for unauthorized function access attempts.
CA-2Control AssessmentsCAControl assessments determine if authorization is enforced for functions and resources, detecting missing authorization weaknesses.
CA-4Security CertificationCARequires verification that authorization checks are present and operational for protected resources.
CA-6AuthorizationCAPrevents systems from commencing operations without assigned authorizing official approval, addressing missing authorization for critical functions.
PS-1Policy and ProceduresPSThe required procedures explicitly address authorization checks for personnel actions, lowering the incidence of missing authorization.
PS-6Access AgreementsPSMandating a signed agreement as a prerequisite for access implements a concrete authorization step that would otherwise be missing.
PS-7External Personnel SecurityPSRequires explicit authorization rules and termination notifications for external personnel, preventing missing authorization checks on retained credentials.
Show 42 more broadly-applicable controls
AC-16Security and Privacy AttributesACRequiring attribute association with information prevents authorization from being performed without necessary security or privacy context.
AC-17Remote AccessACMandating authorization prior to allowing remote connections addresses missing authorization for remote access.
AC-18Wireless AccessACMandating authorization before wireless connections are allowed prevents missing authorization for wireless access.
AC-19Access Control for Mobile DevicesACThe control requires authorization before allowing mobile device connections, directly mitigating missing authorization for system access.
AC-2Account ManagementACRequiring approvals for account creation and specifying authorizations ensures authorization is not missing for system access.
AC-20Use of External SystemsACMandates authorization checks before permitting access or data processing via external systems.
AC-21Information SharingACThe control provides a mechanism for authorized users to determine authorization matches, preventing sharing without proper authorization verification.
AC-24Access Control DecisionsACRequiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.
AC-25Reference MonitorACAlways invoking the reference monitor prevents missing authorization checks for protected resources.
AC-3Access EnforcementACRequiring enforcement of authorizations ensures checks are performed rather than omitted for resources.
AC-4Information Flow EnforcementACMandates authorization checks and enforcement for all information flows, addressing missing authorization.
PM-21Accounting of DisclosuresPMOrganizations must be able to justify every disclosure, which makes missing authorization for data release both detectable and operationally costly.
PM-23Data Governance BodyPMEnsures missing authorization mechanisms for critical data functions are identified and remediated via policy.
PM-24Data Integrity BoardPMProposal review forces explicit authorization checks for each matching program, preventing execution of matching without required approvals.
PM-27Privacy ReportingPMMonitoring privacy program compliance forces identification of missing authorization checks on personal data resources.
PM-29Risk Management Program Leadership RolesPMLeadership accountability for risk management makes missing authorization controls visible at the enterprise level and subject to remediation.
PM-5System InventoryPMAn authoritative inventory ensures no organizational system is omitted from authorization enforcement checks.
SC-43Usage RestrictionsSCThe control mandates authorization prior to allowing use of designated components, eliminating missing authorization paths.
SC-46Cross Domain Policy EnforcementSCImplementing the enforcement point directly addresses missing authorization checks for operations that cross security domains.
SC-50Software-enforced Separation and Policy EnforcementSCRequires explicit authorization checks as part of the enforced policy between separated components.
SC-51Hardware-based ProtectionSCEliminates missing authorization for writes by requiring physical/hardware action under controlled procedures.
SC-7Boundary ProtectionSCMissing authorization for internal functions is mitigated by requiring all external access to traverse managed boundaries.
CA-9Internal System ConnectionsCARequiring explicit authorization for each internal connection prevents missing authorization.
PS-8Personnel SanctionsPSMakes missing authorization checks or bypasses less likely by sanctioning responsible individuals for policy violations.
PT-1Policy and ProceduresPTRequiring designated ownership and periodic updates ensures authorization checks are defined and maintained for PII operations.
PT-2Authority to Process Personally Identifiable InformationPTRequires explicit determination and documentation of authority before any PII processing occurs, addressing missing authorization.
PT-4ConsentPTThe control supplies the missing authorization check that would otherwise allow processing without user approval.
PT-8Computer Matching RequirementsPTEliminates missing authorization by requiring documented approval and agreements prior to initiating any computer matching program.
MA-2Controlled MaintenanceMAMandating explicit approval for removal of components for off-site maintenance addresses missing authorization for critical maintenance functions.
MA-5Maintenance PersonnelMAMaintains lists of authorized personnel and verifies required access authorizations before allowing maintenance.
MA-7Field MaintenanceMAField maintenance is a critical function; the control supplies the missing authorization step by limiting it to specified entities.
IA-13Identity Providers and Authorization ServersIARequiring authorization servers ensures authorization is performed for protected functions.
IA-4Identifier ManagementIARequires explicit authorization before any identifier can be assigned, preventing missing authorization.
PL-11Baseline TailoringPLTailoring ensures the authorization baseline is scoped and augmented so that missing authorization checks are identified and addressed for the target system.
PL-4Rules of BehaviorPLUsers must acknowledge that access is granted only through proper authorization, directly addressing missing authorization.
RA-7Risk ResponseRAMissing authorization is frequently identified by security assessments; organizational risk-response procedures drive remediation, directly limiting an attacker's ability to invoke protected functionality.
RA-9Criticality AnalysisRACriticality analysis highlights functions that must be protected by authorization checks, mitigating missing authorization on those paths.
SA-14Criticality AnalysisSACriticality analysis reveals functions that must be protected by authorization checks, making missing-authorization weaknesses far less likely to affect high-value operations.
SA-3System Development Life CycleSARequiring security roles and risk processes throughout the SDLC ensures that authorization checks are identified as requirements and implemented for every sensitive operation.
AU-14Session AuditAUSession auditing detects missing authorization by exposing unauthorized actions taken within sessions.
CM-5Access Restrictions for ChangeCMMandating authorization for changes prevents missing authorization checks on critical modification functions.
SI-9Information Input RestrictionsSIPrevents missing authorization checks for input operations by restricting the capability itself.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2022-0543 KEV9.710.00.94402022-02-18
CVE-2021-39226 KEV9.69.80.94352021-10-05
CVE-2025-6205 KEV8.59.10.77722025-08-04
CVE-2021-30657 KEV8.15.50.83082021-09-08
CVE-2023-52163 KEV7.98.80.69502025-02-03
CVE-2020-87727.69.80.93612020-02-06
CVE-2023-68757.69.80.93682024-01-11
CVE-2024-92347.69.80.93402024-10-11
CVE-2021-219787.49.80.90502021-03-03
CVE-2022-13297.48.80.93362022-04-19
CVE-2024-48987.49.80.90112024-06-12
CVE-2024-97077.49.80.90282024-10-11
CVE-2018-60007.39.80.89732018-01-22
CVE-2022-10207.39.80.89532022-04-18
CVE-2023-255737.38.60.93632023-03-09
CVE-2023-321177.39.80.89382024-12-09
CVE-2021-213077.28.60.92062021-02-11
CVE-2022-239447.29.10.89922022-01-25
CVE-2021-454677.29.80.88132022-12-26
CVE-2025-89437.29.80.88152025-08-14
CVE-2019-112487.18.20.91012019-08-29
CVE-2022-09527.18.80.88222022-05-02
CVE-2022-42237.08.80.87792022-12-13
CVE-2017-92326.99.80.81612017-05-28
CVE-2019-160976.96.50.93672019-09-08