Weakness · CWE-863
Incorrect Authorization
A permission check exists but is wrong, letting users act beyond their role.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
- CVE-2026-33388Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0Medium 6.4
- CVE-2026-33391Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0Medium 5.3
- CVE-2026-107336Authentication Bypass by Spoofing in MalcolmMedium 6.5
- CVE-2026-107333Incorrect Authorization in MalcolmHigh 8.1
- CVE-2026-92817Inductive Automation Ignition Software Incorrect AuthorizationHigh 8.7
- CVE-2026-62927High 8.7
- CVE-2026-107334Incorrect Authorization in MalcolmMedium 5.4
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- SI-4System MonitoringSystem and Information Integrity · mitigates 8 techniques
- AC-2Account ManagementAccess Control · mitigates 7 techniques
- AC-6Least PrivilegeAccess Control · mitigates 7 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 7 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 7 techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 7 techniques
- AC-3Access EnforcementAccess Control · mitigates 6 techniques
- AC-5Separation of DutiesAccess Control · mitigates 5 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 5 techniques
- CM-5Access Restrictions for ChangeConfiguration Management · mitigates 5 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.