Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is missing authorization (CWE-862)?

In one sentence: Missing authorization means a system knows who you are but never checks whether you are allowed to do what you are asking, so people can reach functions or data that were meant for someone else.

What it is

Authorisation is the permission check. Authentication is the login. A system can handle the login perfectly and still forget the permission check on one page, button or API call.

MITRE defines the weakness, CWE-862, as a product that does not perform an authorization check when an actor tries to access a resource or perform an action. Developers shorten it to “AuthZ”.

It is part of what OWASP calls broken access control, the most common category in its Top 10.

How it works

  1. A person signs in with a low-privilege account, such as a junior technician or an ordinary customer.
  2. The screen only shows the buttons that account should use. That is only a display choice.
  3. The person (or a script) calls a hidden function directly, for example an admin action or someone else’s record.
  4. The server never asks whether this account may do that, so it obeys.

MITRE lists what an attacker can then do: read sensitive data, change it, gain privileges or assume another identity, and in some cases use up resources until the system stops. MITRE also warns that dividing users into roles does not stop a user attacking others who hold the same role, so checks must also cover who owns each record.

Who it affects and how badly

Anything with accounts at different permission levels, and especially anything with many customers on one platform.

  • Sole trader to 10 staff: you meet it through the software you use, such as a remote support tool or a booking system. Worst case: one compromised low-level account becomes full control.
  • 10 to 50 staff: SaaS start-ups and recruitment firms risk one customer or candidate seeing another’s data, and the lost clients that follow.
  • 50 to 250 staff: MSPs are exposed because their remote support tools sit above many client networks.
  • Regulated businesses: healthcare, fintech and insurance must be able to show that access to personal data is restricted to the right people. Missing checks make that hard to show.

Real examples

  • SimpleHelp remote support software (CVE-2024-57726). The US National Vulnerability Database (NVD) records that low-privileged technicians could create API keys with excessive permissions and use them to become server administrator. It is classed as CWE-862 and appears in CISA’s Known Exploited Vulnerabilities catalogue.
  • Cisco Secure Firewall ASA and FTD (CVE-2025-20362). The NVD classes this VPN web server flaw as CWE-862. It was added to the CISA catalogue on 25 September 2025.

How to detect it

  • Test your own application with two accounts of different roles. Try each function as the lower role. Only test systems you own or have written permission to test.
  • Log denied requests and review them. A user repeatedly hitting functions they should not see is a signal.
  • In Microsoft 365 or Google Workspace, review the audit log for role changes and new admin accounts you did not expect.
  • Compare the CISA Known Exploited Vulnerabilities list with your product inventory for remote support tools, VPNs and firewalls.

How to fix or prevent it

  1. Install vendor updates for any product listed as exploited, starting with those facing the internet.
  2. Check authorisation on the server for every request, not in the screen design (MITRE and OWASP).
  3. Deny by default, and grant access only for named roles (OWASP).
  4. Use a vetted authorisation library or framework instead of writing your own checks (MITRE).
  5. Add checks for who owns each record, not just which role the user has (OWASP).
  6. Give people the least access they need, and remove accounts that are no longer needed.

Related terms

Frequently asked questions

What does CWE-862 mean?
It is MITRE’s identifier for a missing authorization check, where a product does not check permission before an action or access to a resource.

Is hiding a button enough to protect a function?
No. The server must check permission on every request, because a person can call the function directly.

Does role-based access control solve it?
Not fully. MITRE notes it does not stop a user attacking others with the same role, so record ownership must be checked too.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.