CWE Top 25 — #11
Missing Authorization
CWE-862An endpoint enforces authentication but not authorisation — any logged-in user can access any other user's data.
GateTest coverage
Not directly covered today. GateTest has no dedicated rule for this class yet — it depends on application logic or runtime behaviour a static pattern cannot see. The remediation below says which adjacent GateTest checks apply.
Example
app.get('/api/users/:id/orders', authMiddleware, async (req, res) => { res.json(await db.query('SELECT * FROM orders WHERE user_id = $1', [req.params.id])) }) — any logged-in user can read any user's orders.How to fix it
On every endpoint that returns user-owned data, compare req.user.id to the requested record's owner. Test with two real accounts. GateTest's authBypass module catches routes with no authentication at all (CWE-306); an object-level authorisation gap like this one passes a static rule because the auth middleware is present, so no GateTest scan reaches it today — test it with the two-account check above.
Frequently asked questions
What is CWE-862 (Missing Authorization)?
An endpoint enforces authentication but not authorisation — any logged-in user can access any other user's data.
How do I fix missing authorization?
On every endpoint that returns user-owned data, compare req.user.id to the requested record's owner. Test with two real accounts. GateTest's authBypass module catches routes with no authentication at all (CWE-306); an object-level authorisation gap like this one passes a static rule because the auth middleware is present, so no GateTest scan reaches it today — test it with the two-account check above.
Does GateTest detect CWE-862?
Not with a dedicated rule today. Missing Authorization depends on application logic or runtime behaviour that a static pattern cannot see on its own. On every endpoint that returns user-owned data, compare req.user.id to the requested record's owner. Test with two real accounts. GateTest's authBypass module catches routes with no authentication at all (CWE-306); an object-level authorisation gap like this one passes a static rule because the auth middleware is present, so no GateTest scan reaches it today — test it with the two-account check above.
What rank is Missing Authorization in the CWE Top 25?
Missing Authorization is ranked #11 in the MITRE 2023 CWE Top 25 Most Dangerous Software Weaknesses list. The ranking reflects both prevalence (how often it appears in real CVEs) and severity (the typical impact when it's exploited).