Missing Authorization (CWE-862)
CWE-862, Missing Authorization, is the MITRE CWE entry for weaknesses in which the product does not perform an authorization check when an actor attempts to access a resource or perform an action. The database tracks 15 CVE records mapped to CWE-862, and 11 of them are in the CISA Known Exploited Vulnerabilities catalog.
Updated
About CWE-862
MITRE lists these common consequences: Read Application Data, Read Files or Directories, Modify Application Data, Modify Files or Directories, Gain Privileges or Assume Identity, Bypass Protection Mechanism, DoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other), affecting confidentiality, integrity, access control, availability.
- MITRE name
- Missing Authorization
- Abstraction
- Class: a very abstract weakness, typically independent of language or technology
- Status
- Incomplete
Also Known As
- AuthZ
Mitigations
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
- Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
Detection
MITRE lists these detection methods: Architecture or Design Review (high), Manual Analysis (moderate), Automated Static Analysis (limited), Automated Dynamic Analysis, Manual Static Analysis - Binary or Bytecode.
CWE-862 in the KEV Catalog
as of 2026-11-14- 11 CISA KEV entries name Missing Authorization (CWE-862) in their CVE record, ranking 31st among the 195 weaknesses named in the catalog.
- CISA added 0 CWE-862 entries to the KEV catalog in 2024, 4 in 2025, and 3 so far in 2026.
- Apple has the most CWE-862 entries in the CISA KEV catalog (2).
- CISA marks 9% of CWE-862 KEV entries (1 of 11) as known to be used in ransomware campaigns, compared with 20% of all KEV entries.
- CISA's SSVC enrichment rates 27% of CWE-862 KEV entries with SSVC data (3 of 11) as automatable, compared with 41% across the catalog.
Related Attack Patterns
1 CAPEC patternsCAPEC-665Exploitation of Thunderbolt Protection FlawsDetailed · Severity Very High · Likelihood Low
Loading…
CWE-862 Vulnerabilities
15 CVEs| CVE | Title | Vendor | CVSS | EPSS | KEV | Published |
|---|---|---|---|---|---|---|
| CVE-2026-123039KEV Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket | Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket | checkpoint | 7.8 | 1.3% | KEV | 2026-11-12 |
| CVE-2026-84869KEV ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | ConnectWise | 9.9 | 1.2% | KEV | 2026-09-08 |
| CVE-2024-57726KEV SimpleHelp Missing Authorization Vulnerability | SimpleHelp Missing Authorization Vulnerability | - | 9.9 | 66.4% | KEV | 2025-01-15 |
| CVE-2023-52163KEV Digiever DS-2105 Pro Missing Authorization Vulnerability | Digiever DS-2105 Pro Missing Authorization Vulnerability | - | 8.8 | 97.1% | KEV | 2025-02-03 |
| CVE-2025-40602KEV SonicWall SMA1000 Missing Authorization Vulnerability | SonicWall SMA1000 Missing Authorization Vulnerability | SonicWall | 6.6 | 2.8% | KEV | 2025-12-18 |
| CVE-2025-6205KEV Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 | Missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 | Dassault Systèmes | 9.1 | 67.2% | KEV | 2025-08-04 |
| CVE-2025-20362KEV Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization Vulnerability | Cisco | 6.5 | 86.7% | KEV | 2025-09-25 |
| CVE-2022-0543KEV Debian-specific Redis Server Lua Sandbox Escape Vulnerability | Debian-specific Redis Server Lua Sandbox Escape Vulnerability | Debian | 10.0 | 99.4% | KEV | 2022-02-18 |
| CVE-2021-30657KEV Apple macOS Unspecified Vulnerability | Apple macOS Unspecified Vulnerability | Apple | 5.5 | 68.5% | KEV | 2021-09-08 |
| CVE-2021-37976KEV Google Chromium Information Disclosure Vulnerability | Google Chromium Information Disclosure Vulnerability | 6.5 | 19.9% | KEV | 2021-10-08 | |
| CVE-2021-30713KEV Apple macOS Unspecified Vulnerability | Apple macOS Unspecified Vulnerability | Apple | 7.8 | 7.0% | KEV | 2021-09-08 |
| CVE-2026-41679 Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass | Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass | paperclipai | 10.0 | 31.7% | 2026-04-23 | |
| CVE-2026-25939 FUXA Unauthenticated Remote Arbitrary Scheduler Write | FUXA Unauthenticated Remote Arbitrary Scheduler Write | frangoteam | 9.3 | 24.3% | 2026-02-09 | |
| CVE-2026-0628 | - | 8.8 | 20.9% | 2026-01-06 | ||
| CVE-2026-1830 Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload | Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload | davidfcarr | 9.8 | 8.1% | 2026-04-09 |
Frequently Asked Questions
What is CWE-862?→
CWE-862 (Missing Authorization) is a MITRE CWE entry. The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How many exploited vulnerabilities are classified as CWE-862?→
This database lists 15 CVE records mapped to CWE-862 by their CVE Numbering Authority. 11 of them are in the CISA Known Exploited Vulnerabilities catalog, and CISA links 1 to known ransomware campaigns. Examples include CVE-2026-123039, CVE-2026-84869, CVE-2024-57726.
Weakness description, consequences, and mitigations from the CWE List, © The MITRE Corporation, used under the CWE Terms of Use. CWE mappings come from each CVE record's CNA. Exploited-in-the-wild data from the CISA KEV catalog (CC0). This site is not affiliated with or endorsed by MITRE or CISA. Attack patterns from CAPEC 3.9, © The MITRE Corporation, used under the CAPEC Terms of Use.