CWE-862 - Missing Authorization

Description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource. When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.

Common Consequences: Scope: Confidentiality
Impact: Read Application Data, Read Files or Directories
Notes: An attacker could read sensitive data, either by reading the data directly from a data store that is not restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
Scope: Integrity
Impact: Modify Application Data, Modify Files or Directories
Notes: An attacker could modify sensitive data, either by writing the data directly to a data store that is not restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Scope: Access Control
Impact: Gain Privileges or Assume Identity, Bypass Protection Mechanism
Notes: An attacker could gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.