Compliance Node Overview
CWE-863 (Incorrect Authorization) is a CWE Top 25 weakness covering authorization decisions that are made but performed with incorrect logic, missing conditions, or buggy rule evaluation. CWE-863 is defined as: the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. The Extended Description notes that authorization represents the process of determining whether an authenticated user can access a given resource, based on their privileges and applicable access-control specifications; when this verification fails to function correctly, attackers can bypass intended restrictions. Common Consequences include confidentiality impact (attackers may bypass access restrictions to read sensitive data directly from unprotected data stores or access privileged functionality); integrity impact (attackers can modify sensitive information by writing to inadequately restricted data stores or accessing privileged functionality without authorization); access control impact (attackers gain unauthorized privileges by modifying critical data or accessing restricted functionality, potentially assuming false identities); and availability and execution impact (with elevated privileges, attackers execute unauthorized commands or code, potentially causing system crashes, resource exhaustion, or denial of service). Potential Mitigations include implementing RBAC across anonymous, normal, privileged, and administrative areas; performing authorization checks aligned with business logic, not just generic resource controls; employing vetted authorization frameworks like JAAS or OWASP ESAPI; enforcing server-side access control on every page and preventing caching of sensitive information; and applying default-deny policies in OS and server ACLs.
Pillar: Cybersecurity · Authority: MITRE Corporation / Common Weakness Enumeration · Version: 1.0.0 · Last updated:
Primary source: https://cwe.mitre.org/data/definitions/863.html
SHA-256 integrity: a1ca21b071f759dbf7253bbc54a0e2ac20313906b2520b24f9c7cbf9b4bce224
Primary Citations — 10 traced to source
- CWE-863: Incorrect Authorization - MITRE Common Weakness Enumeration at https://cwe.mitre.org/data/definitions/863.html
- CWE-863 Definition - the product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check
+ 8 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access