Missing Authorization
CWE-862: Missing Authorization
Missing authorization means the software performs an action or returns a resource without checking whether the caller is allowed to do so at all. The user may be authenticated, but nothing confirms that their role or relationship to the data permits the request. It is common in APIs and back-end endpoints that developers assume are only reachable through a user interface that hides them, and it is the root cause behind many privilege escalation findings.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- An /api/admin/users endpoint checks that a session exists but never checks that the session belongs to an administrator.
- A mobile app's back end exposes a delete-account call that accepts any account id from any logged-in user.
- A plugin registers an AJAX action available to every authenticated user that changes site-wide settings.
How to mitigate it
- Deny by default: every endpoint must make an explicit authorization decision before doing any work.
- Centralize authorization in middleware or a policy layer so new routes inherit checks instead of relying on developers to remember them.
- Enforce checks on the server for every request; hiding a button or menu item is not access control.
- Add automated tests that call each privileged endpoint as a low-privilege user and assert the request is refused.
Go deeper
Practice this topic
Test your knowledge of Missing Authorization with exam-style practice questions.