CWE · MITRE source
CWE-863Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (43)AI
Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
AC-1 | Policy and Procedures | AC | Periodic review and update of procedures reduces incorrect authorization implementations over time. |
AC-13 | Supervision and Review — Access Control | AC | Supervision identifies cases where authorization logic incorrectly permits unauthorized actions. |
AC-16 | Security and Privacy Attributes | AC | Defining permitted attribute values and auditing modifications reduces the chance of incorrect authorization outcomes due to tampered or missing labels. |
SC-14 | Public Access Protections | SC | Addresses incorrect policy decisions that would otherwise allow public users to exceed intended privileges. |
SC-26 | Decoys | SC | Decoys detect incorrect authorization decisions through attacker interactions with deliberately misprotected decoy objects. |
SC-43 | Usage Restrictions | SC | Ongoing monitoring and control of component usage detects and stops incorrect authorization decisions at runtime. |
PM-10 | Authorization Process | PM | Authorization reviews within the risk management program detect and prevent incorrect authorization logic or policy enforcement before systems receive approval to operate. |
PM-12 | Insider Threat Program | PM | Insider threat processes catch and remediate incorrect authorization decisions before or after exploitation occurs. |
PM-18 | Privacy Program Plan | PM | The plan's coordination, role assignment, and control-description requirements reduce the chance that authorization logic for privacy-relevant resources will be implemented inconsistently or incorrectly. |
CA-2 | Control Assessments | CA | The assessment evaluates authorization logic and enforcement, identifying incorrect authorization that could be exploited. |
CA-4 | Security Certification | CA | Certification evaluates whether authorization decisions are correctly implemented and enforced. |
CA-6 | Authorization | CA | The authorization process includes review of common controls and system security, helping detect and correct incorrect authorization implementations. |
PT-2 | Authority to Process Personally Identifiable Information | PT | Restricts processing strictly to documented authorized uses, mitigating incorrect authorization decisions for sensitive data. |
PT-4 | Consent | PT | Consent logic ensures authorization decisions governing PII are both present and correctly applied. |
PT-8 | Computer Matching Requirements | PT | Addresses incorrect authorization by requiring independent verification of results and an opportunity to contest before any adverse action is taken. |
Show 28 more broadly-applicable controls
AC-17 | Remote Access | AC | The authorization process and usage restrictions help prevent incorrect authorization for remote access types. |
AC-18 | Wireless Access | AC | Establishing configuration and connection requirements helps ensure correct rather than incorrect authorization for wireless access. |
AC-19 | Access Control for Mobile Devices | AC | Establishing connection authorization processes for mobile devices helps ensure authorization decisions are correctly implemented rather than incorrect. |
AC-2 | Account Management | AC | Monitoring account use, notifying on changes, and reviewing accounts for compliance corrects incorrect authorization assignments. |
AC-20 | Use of External Systems | AC | Ensures authorization decisions for external system use are correctly implemented and enforced. |
AC-21 | Information Sharing | AC | It assists users in evaluating and applying correct authorization decisions when sharing information with external partners. |
AC-24 | Access Control Decisions | AC | Applying decisions to each request prior to enforcement mitigates incorrect authorization by enforcing consistent policy evaluation. |
AC-25 | Reference Monitor | AC | The small, testable reference monitor reduces the likelihood of incorrect authorization implementations. |
AC-3 | Access Enforcement | AC | Mandating policy-based enforcement reduces the chance of incorrect authorization logic being used. |
AC-4 | Information Flow Enforcement | AC | Applies only approved authorizations to information flows, mitigating incorrect authorization decisions. |
SC-46 | Cross Domain Policy Enforcement | SC | The mechanism applies correct, centrally managed authorization rules at domain boundaries, blocking incorrect authorization logic from being exploited. |
SC-50 | Software-enforced Separation and Policy Enforcement | SC | Policy enforcement mechanisms correct or prevent flawed authorization logic across domain boundaries. |
SC-51 | Hardware-based Protection | SC | Ensures authorization decisions for firmware changes cannot be bypassed by software and must follow explicit re-enable steps. |
SC-7 | Boundary Protection | SC | Incorrect authorization decisions are enforced or detected at external and key internal managed interfaces. |
PM-23 | Data Governance Body | PM | Drives review and correction of flawed authorization logic applied to organizational data. |
PM-24 | Data Integrity Board | PM | Annual re-evaluation of active programs detects and corrects cases where authorization rules have become incorrect or overly broad. |
PM-29 | Risk Management Program Leadership Roles | PM | Org-wide risk perspective ensures authorization logic is reviewed and corrected rather than implemented inconsistently per system. |
CA-9 | Internal System Connections | CA | Periodic review and documentation of connection needs reduces incorrect authorization. |
IA-13 | Identity Providers and Authorization Servers | IA | Centralized authorization servers reduce incorrect authorization by enforcing consistent policies. |
IA-4 | Identifier Management | IA | Enforces correct authorization checks during the identifier assignment process. |
MA-5 | Maintenance Personnel | MA | Verifies that non-escorted maintenance personnel possess required access authorizations to avoid incorrect authorization. |
MA-7 | Field Maintenance | MA | By defining exactly who may perform field maintenance, the control corrects potential authorization errors for this activity. |
PS-1 | Policy and Procedures | PS | Policy-driven user provisioning and review processes reduce incorrect authorization assignments arising from ad-hoc personnel decisions. |
PS-6 | Access Agreements | PS | Verification that individuals have signed current agreements ensures the authorization decision is based on up-to-date, explicitly accepted rules rather than stale or absent approvals. |
AU-14 | Session Audit | AU | Enables detection of incorrect authorization through review of session-level activities and decisions. |
CM-5 | Access Restrictions for Change | CM | The control requires correct implementation of authorization specifically tied to change operations. |
RA-9 | Criticality Analysis | RA | By surfacing critical resources and functions, the control drives correct authorization logic instead of incorrect authorization decisions. |
SI-9 | Information Input Restrictions | SI | Reduces incorrect authorization decisions by gating all input at the personnel/process level. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2019-7192 KEV | 9.6 | 9.8 | 0.9430 | 2019-12-05 |
CVE-2022-46169 KEV | 9.6 | 9.8 | 0.9447 | 2022-12-05 |
CVE-2023-38035 KEV | 9.6 | 9.8 | 0.9442 | 2023-08-21 |
CVE-2023-22518 KEV | 9.6 | 9.8 | 0.9437 | 2023-10-31 |
CVE-2024-38856 KEV | 9.6 | 9.8 | 0.9437 | 2024-08-05 |
CVE-2021-40655 KEV | 9.1 | 7.5 | 0.9261 | 2021-09-24 |
CVE-2018-13382 KEV | 9.0 | 9.1 | 0.8708 | 2019-06-04 |
CVE-2021-3493 KEV | 8.4 | 8.8 | 0.7707 | 2021-04-17 |
CVE-2024-21287 KEV | 7.7 | 7.5 | 0.6983 | 2024-11-18 |
CVE-2024-6782 | 7.6 | 9.8 | 0.9384 | 2024-08-06 |
CVE-2024-45216 | 7.6 | 9.8 | 0.9408 | 2024-10-16 |
CVE-2022-22978 | 7.4 | 9.8 | 0.9022 | 2022-05-19 |
CVE-2022-0824 | 7.3 | 8.8 | 0.9268 | 2022-03-02 |
CVE-2022-0482 | 7.3 | 9.1 | 0.9079 | 2022-03-09 |
CVE-2023-24880 KEV | 7.3 | 4.4 | 0.7331 | 2023-03-14 |
CVE-2025-29927 | 7.3 | 9.1 | 0.9206 | 2025-03-21 |
CVE-2021-21389 | 7.2 | 8.1 | 0.9330 | 2021-03-26 |
CVE-2019-7304 | 7.0 | 9.8 | 0.8355 | 2019-04-23 |
CVE-2020-13957 | 7.0 | 9.8 | 0.8482 | 2020-10-13 |
CVE-2023-2640 | 7.0 | 7.8 | 0.9139 | 2023-07-26 |
CVE-2021-36749 | 6.9 | 6.5 | 0.9384 | 2021-09-24 |
CVE-2021-3577 | 6.9 | 8.8 | 0.8643 | 2021-11-12 |
CVE-2022-32532 | 6.8 | 9.8 | 0.8095 | 2022-06-29 |
CVE-2023-26258 | 6.7 | 9.8 | 0.7936 | 2023-07-03 |
CVE-2020-36289 | 6.6 | 5.3 | 0.9200 | 2021-05-12 |