CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5683 vulnerabilities reference this CWE, most recent first.
GHSA-4QXC-98VX-FP5G
Vulnerability from github – Published: 2025-01-21 21:30 – Updated: 2025-01-21 21:30Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2025-21561"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T21:15:22Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM Purchasing. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise SCM Purchasing accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise SCM Purchasing accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N).",
"id": "GHSA-4qxc-98vx-fp5g",
"modified": "2025-01-21T21:30:56Z",
"published": "2025-01-21T21:30:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21561"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4R5R-CCR6-Q6F6
Vulnerability from github – Published: 2026-01-20 20:55 – Updated: 2026-02-27 22:03Summary
A broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.
Impact
Fleet’s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege “Observer” role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.
Patches
- 4.78.3
- 4.77.1
- 4.76.2
- 4.75.2
- 4.53.3
Workarounds
If an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist.
For more information
If you have any questions or comments about this advisory:
Email us at security@fleetdm.com Join #fleet in osquery Slack
Credits
We thank @secfox-ai for responsibly reporting this issue.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.78.0"
},
{
"fixed": "4.78.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.77.0"
},
{
"fixed": "4.77.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.76.0"
},
{
"fixed": "4.76.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet"
},
"ranges": [
{
"events": [
{
"introduced": "4.75.0"
},
{
"fixed": "4.75.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/fleetdm/fleet/v4"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.78.3-0.20260112221730-5c030e32a3a9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-23517"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-20T20:55:14Z",
"nvd_published_at": "2026-01-21T22:15:49Z",
"severity": "HIGH"
},
"details": "### Summary\n\nA broken access control issue in Fleet allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege users could view internal server diagnostics and trigger resource-intensive profiling operations.\n\n### Impact\n\nFleet\u2019s debug/pprof endpoints are accessible to any authenticated user regardless of role, including the lowest-privilege \u201cObserver\u201d role. This allows low-privilege users to access sensitive server internals, including runtime profiling data and in-memory application state, and to trigger CPU-intensive profiling operations that could lead to denial of service.\n\n### Patches\n\n- 4.78.3\n- 4.77.1\n- 4.76.2\n- 4.75.2\n- 4.53.3\n\n### Workarounds\n\nIf an immediate upgrade is not possible, users should put the debug/pprof endpoints behind an IP allowlist. \n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\nEmail us at [security@fleetdm.com](mailto:security@fleetdm.com)\nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nWe thank @secfox-ai for responsibly reporting this issue.",
"id": "GHSA-4r5r-ccr6-q6f6",
"modified": "2026-02-27T22:03:20Z",
"published": "2026-01-20T20:55:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-4r5r-ccr6-q6f6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23517"
},
{
"type": "WEB",
"url": "https://github.com/fleetdm/fleet/commit/5c030e32a3a9bc512355b5e1bf19636e4e6d0317"
},
{
"type": "PACKAGE",
"url": "https://github.com/fleetdm/fleet"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4334"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Fleet has an Access Control vulnerability in debug/pprof endpoints"
}
GHSA-4R7W-CVQP-58F8
Vulnerability from github – Published: 2022-05-05 00:00 – Updated: 2022-05-12 00:01Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.
{
"affected": [],
"aliases": [
"CVE-2022-1502"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-04T07:15:00Z",
"severity": "MODERATE"
},
"details": "Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.",
"id": "GHSA-4r7w-cvqp-58f8",
"modified": "2022-05-12T00:01:23Z",
"published": "2022-05-05T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1502"
},
{
"type": "WEB",
"url": "https://advisories.octopus.com/post/2022/sa2022-03"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4R8M-M7VP-CJ97
Vulnerability from github – Published: 2022-07-26 00:00 – Updated: 2022-07-28 00:00WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
{
"affected": [],
"aliases": [
"CVE-2022-34570"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-25T22:15:00Z",
"severity": "HIGH"
},
"details": "WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.",
"id": "GHSA-4r8m-m7vp-cj97",
"modified": "2022-07-28T00:00:49Z",
"published": "2022-07-26T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34570"
},
{
"type": "WEB",
"url": "https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN579%20X3__messages.md"
},
{
"type": "WEB",
"url": "https://www.wavlink.com/en_us/product/WL-WN579X3.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4RC4-8XQR-5G82
Vulnerability from github – Published: 2023-10-05 15:30 – Updated: 2024-04-04 08:19A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
{
"affected": [],
"aliases": [
"CVE-2022-3248"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-05T14:15:09Z",
"severity": "HIGH"
},
"details": "A flaw was found in OpenShift API, as admission checks do not enforce \"custom-host\" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.",
"id": "GHSA-4rc4-8xqr-5g82",
"modified": "2024-04-04T08:19:16Z",
"published": "2023-10-05T15:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3248"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2022-3248"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072188"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4RV2-F267-RH4V
Vulnerability from github – Published: 2022-02-02 00:01 – Updated: 2022-03-18 00:01The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication
{
"affected": [],
"aliases": [
"CVE-2021-25097"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-352",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-01T13:15:00Z",
"severity": "MODERATE"
},
"details": "The LabTools WordPress plugin through 1.0 does not have proper authorisation and CSRF check in place when deleting publications, allowing any authenticated users, such as subscriber to delete arbitrary publication",
"id": "GHSA-4rv2-f267-rh4v",
"modified": "2022-03-18T00:01:34Z",
"published": "2022-02-02T00:01:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25097"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/67f5beb8-2cb0-4b43-87c7-dead9c005f9c"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-4V65-XQCJ-WPGG
Vulnerability from github – Published: 2025-03-21 09:30 – Updated: 2025-03-27 23:27Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.4.0"
},
{
"fixed": "10.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "9.11.0"
},
{
"fixed": "9.11.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.5.0"
},
{
"fixed": "10.5.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.5.0"
]
}
],
"aliases": [
"CVE-2025-25274"
],
"database_specific": {
"cwe_ids": [
"CWE-77",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T21:25:18Z",
"nvd_published_at": "2025-03-21T09:15:12Z",
"severity": "MODERATE"
},
"details": "Mattermost versions 10.4.x \u003c= 10.4.2, 10.3.x \u003c= 10.3.3, 9.11.x \u003c= 9.11.8\u00a0fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.",
"id": "GHSA-4v65-xqcj-wpgg",
"modified": "2025-03-27T23:27:19Z",
"published": "2025-03-21T09:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25274"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost Fails to Restrict Command Execution in Archived Channels"
}
GHSA-4V6R-G9PP-VMW9
Vulnerability from github – Published: 2023-09-05 18:30 – Updated: 2024-04-04 07:29BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.
{
"affected": [],
"aliases": [
"CVE-2017-9453"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-09-05T18:15:08Z",
"severity": "CRITICAL"
},
"details": "BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.",
"id": "GHSA-4v6r-g9pp-vmw9",
"modified": "2024-04-04T07:29:27Z",
"published": "2023-09-05T18:30:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9453"
},
{
"type": "WEB",
"url": "https://docs.bmc.com/docs/serverautomation/2002/notification-of-critical-security-issue-in-bmc-server-automation-cve-2017-9453-1020706453.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-4V96-M8XV-X83V
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2025-02-12 21:53Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions between 3.0.2 - 6.5.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "atlassian-connect-express"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.2"
},
{
"fixed": "6.6.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-26073"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-02-12T21:53:02Z",
"nvd_published_at": "2021-04-16T03:15:00Z",
"severity": "HIGH"
},
"details": "Broken Authentication in Atlassian Connect Express (ACE) from version 3.0.2 before version 6.6.0: Atlassian Connect Express is a Node.js package for building Atlassian Connect apps. Authentication between Atlassian products and the Atlassian Connect Express app occurs with a server-to-server JWT or a context JWT. Atlassian Connect Express versions between 3.0.2 - 6.5.0 erroneously accept context JWTs in lifecycle endpoints (such as installation) where only server-to-server JWTs should be accepted, permitting an attacker to send authenticated re-installation events to an app.",
"id": "GHSA-4v96-m8xv-x83v",
"modified": "2025-02-12T21:53:02Z",
"published": "2022-05-24T22:28:12Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26073"
},
{
"type": "WEB",
"url": "https://community.developer.atlassian.com/t/action-required-atlassian-connect-vulnerability-a%5B%E2%80%A6%5Dypass-of-app-qsh-verification-via-context-jwts/47072"
},
{
"type": "WEB",
"url": "https://confluence.atlassian.com/pages/viewpage.action?pageId=1051986099"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20210604-0004"
},
{
"type": "PACKAGE",
"url": "http://bitbucket.org/atlassian/atlassian-connect-express"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Broken Authentication in Atlassian Connect Express"
}
GHSA-4V9X-CQC5-J645
Vulnerability from github – Published: 2026-05-05 17:58 – Updated: 2026-05-05 17:58Summary
Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.
Details
The following functions are affected under the Authentication endpoint: getAuthorisedNames, getPermissionsForUser, hasPermission, addPermission, and removePermission.
The vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments. In the logs, the exploit shows as follows:
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames
[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission
Impact
An attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.
Patch
A patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "codechecker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "6.27.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25660"
],
"database_specific": {
"cwe_ids": [
"CWE-290",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-05T17:58:09Z",
"nvd_published_at": "2026-04-24T14:16:18Z",
"severity": "CRITICAL"
},
"details": "### Summary\nAuthentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permissions to any existing user in CodeChecker.\n\n### Details\n\nThe following functions are affected under the Authentication endpoint: `getAuthorisedNames`, `getPermissionsForUser`, `hasPermission`, `addPermission`, and `removePermission`.\n\nThe vulnerability allows unauthenticated users to execute these function calls with arbitrary arguments.\nIn the logs, the exploit shows as follows:\n```\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@getAuthorisedNames\n[INFO 2026-04-23 21:23] - 127.0.0.1:42654 -- [Anonymous] POST /v6.67/Authentication@addPermission\n```\n\n### Impact\nAn attacker with a CodeChecker user can effectively acquire superuser permissions by calling these endpoints.\n\n### Patch\nA patch is available at https://github.com/Ericsson/codechecker/releases/tag/v6.27.4.",
"id": "GHSA-4v9x-cqc5-j645",
"modified": "2026-05-05T17:58:09Z",
"published": "2026-05-05T17:58:09Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Ericsson/codechecker/security/advisories/GHSA-4v9x-cqc5-j645"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25660"
},
{
"type": "PACKAGE",
"url": "https://github.com/Ericsson/codechecker"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P",
"type": "CVSS_V4"
}
],
"summary": "Codechecker has an authentication bypass for certain API calls"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.