CWE-1111 is documentation that does not adequately define a product's inputs, outputs or system and software interfaces.
MITRE marks it as not language specific, as a quality issue with no direct security implications, and as unsuitable for mapping real vulnerabilities.
How it happens
Interfaces grow by accretion. A new field is accepted by an endpoint, a file format gains an optional section, a command reads one more environment value. The code changes, and the description of what the product accepts and emits does not.
What an attacker gains
Nothing directly. MITRE lists reduced maintainability and increased analytical complexity. The security link is that input handling is where many vulnerabilities live, and you cannot validate or test inputs that nobody has listed.
How to find it
The record lists no detection methods. Compare the documented interfaces to the real ones: list the actual endpoints, parameters, files and configuration the product reads, then see what is missing from the docs.
How to fix it
The record has no formal mitigations. As a practice, document each interface with its inputs, accepted formats and ranges, outputs, and error behaviour. Where possible generate the reference from the code or a schema so it cannot drift.
Quick check
What counts as an interface here?
Anything the product takes in or sends out, including APIs, files, command line options and other software it talks to.
