CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5517 vulnerabilities reference this CWE, most recent first.
GHSA-JG7H-CR7W-5FC6
Vulnerability from github – Published: 2022-07-02 00:00 – Updated: 2022-07-14 00:00An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects.
{
"affected": [],
"aliases": [
"CVE-2022-2243"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-01T16:15:00Z",
"severity": "MODERATE"
},
"details": "An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects.",
"id": "GHSA-jg7h-cr7w-5fc6",
"modified": "2022-07-14T00:00:17Z",
"published": "2022-07-02T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2243"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/1546138"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2243.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/360666"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JG87-7JXH-JP92
Vulnerability from github – Published: 2026-03-11 03:31 – Updated: 2026-03-11 03:31Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.
{
"affected": [],
"aliases": [
"CVE-2026-21286"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T03:15:53Z",
"severity": "MODERATE"
},
"details": "Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction.",
"id": "GHSA-jg87-7jxh-jp92",
"modified": "2026-03-11T03:31:27Z",
"published": "2026-03-11T03:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21286"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb26-05.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JG9M-WR8W-VHXV
Vulnerability from github – Published: 2023-11-01 18:30 – Updated: 2023-11-01 18:30A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by the FMC Software. This vulnerability is due to insufficient authorization of configuration commands that are sent through the web service interface. An attacker could exploit this vulnerability by authenticating to the FMC web services interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute certain configuration commands on the targeted FTD device. To successfully exploit this vulnerability, an attacker would need valid credentials on the FMC Software.
{
"affected": [],
"aliases": [
"CVE-2023-20048"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-11-01T18:15:08Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense (FTD) device that is managed by the FMC Software. This vulnerability is due to insufficient authorization of configuration commands that are sent through the web service interface. An attacker could exploit this vulnerability by authenticating to the FMC web services interface and sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to execute certain configuration commands on the targeted FTD device. To successfully exploit this vulnerability, an attacker would need valid credentials on the FMC Software.",
"id": "GHSA-jg9m-wr8w-vhxv",
"modified": "2023-11-01T18:30:33Z",
"published": "2023-11-01T18:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-20048"
},
{
"type": "WEB",
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-cmd-inj-29MP49hN"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JGCF-RF45-2F8V
Vulnerability from github – Published: 2026-04-16 20:40 – Updated: 2026-04-27 14:20Impact
Images rendered in templates or otherwise accessed via DBFile::getURL() or DBFile::getSourceURL() incorrectly add an access grant to the current session, which bypasses file permissions.
This usually happens when creating an image variant, for example using a manipulation method like ScaleWidth() or Convert().
Note that if you use DBFile directly in the $db configuration for a DataObject class that doesn't subclass File, and if you were setting the visibility of those files to "protected", those files will now need an explicit access grant to be accessed. If you do not want to explicitly provide access grants for these files (i.e. you want these files to be accessible by default), you should use the "public" visibility.
Reported by
Restruct web & apps
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/assets"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/assets"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-24749"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-16T20:40:37Z",
"nvd_published_at": "2026-04-16T18:16:44Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nImages rendered in templates or otherwise accessed via `DBFile::getURL()` or `DBFile::getSourceURL()` incorrectly add an access grant to the current session, which bypasses file permissions.\n\nThis usually happens when creating an image variant, for example using a manipulation method like `ScaleWidth()` or `Convert()`.\n\nNote that if you use `DBFile` directly in the `$db` configuration for a `DataObject` class that doesn\u0027t subclass `File`, and if you were setting the visibility of those files to \"protected\", those files will now need an explicit access grant to be accessed. If you do not want to explicitly provide access grants for these files (i.e. you want these files to be accessible by default), you should use the \"public\" visibility.\n\n### Reported by\n\nRestruct web \u0026 apps",
"id": "GHSA-jgcf-rf45-2f8v",
"modified": "2026-04-27T14:20:04Z",
"published": "2026-04-16T20:40:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/silverstripe/silverstripe-assets/security/advisories/GHSA-jgcf-rf45-2f8v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24749"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/assets/CVE-2026-24749.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/silverstripe/silverstripe-assets"
},
{
"type": "WEB",
"url": "https://www.silverstripe.org/download/security-releases/cve-2026-24749"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Silverstripe Assets Module has a DBFile::getURL() permission bypass"
}
GHSA-JGFQ-MGXG-4QWM
Vulnerability from github – Published: 2026-01-27 09:30 – Updated: 2026-07-16 12:31The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2026-21721"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-27T09:15:48Z",
"severity": "HIGH"
},
"details": "The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization\u2011internal privilege escalation.",
"id": "GHSA-jgfq-mgxg-4qwm",
"modified": "2026-07-16T12:31:43Z",
"published": "2026-01-27T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2914"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2920"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3078"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3529"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40138"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:5633"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8229"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433242"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21721.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JGH8-23P9-P5X7
Vulnerability from github – Published: 2022-05-24 19:15 – Updated: 2022-10-27 19:00The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.
{
"affected": [],
"aliases": [
"CVE-2021-34647"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-22T18:15:00Z",
"severity": "MODERATE"
},
"details": "The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information.",
"id": "GHSA-jgh8-23p9-p5x7",
"modified": "2022-10-27T19:00:39Z",
"published": "2022-05-24T19:15:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-34647"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ninja-forms/trunk/includes/Routes/Submissions.php?rev=2543837#L107"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/blog/2021/09/recently-patched-vulnerabilities-in-ninja-forms-plugin-affects-over-1-million-site-owners"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JGP3-6M3X-66V7
Vulnerability from github – Published: 2023-06-28 18:30 – Updated: 2024-04-04 05:15there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-270403821References: N/A
{
"affected": [],
"aliases": [
"CVE-2023-21225"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-28T18:15:16Z",
"severity": "HIGH"
},
"details": "there is a possible way to bypass the protected confirmation screen due to Failure to lock display power. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-270403821References: N/A",
"id": "GHSA-jgp3-6m3x-66v7",
"modified": "2024-04-04T05:15:59Z",
"published": "2023-06-28T18:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21225"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/pixel/2023-06-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JGP3-92WQ-G4PQ
Vulnerability from github – Published: 2025-10-27 00:30 – Updated: 2025-10-27 00:30GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.
{
"affected": [],
"aliases": [
"CVE-2025-11971"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-27T00:15:40Z",
"severity": "MODERATE"
},
"details": "GitLab has remediated an issue in GitLab EE affecting all versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits.",
"id": "GHSA-jgp3-92wq-g4pq",
"modified": "2025-10-27T00:30:50Z",
"published": "2025-10-27T00:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11971"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2025/10/22/patch-release-gitlab-18-5-1-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/566587"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JGPH-W8RH-XF5P
Vulnerability from github – Published: 2024-01-23 12:49 – Updated: 2024-01-29 14:22Impact
canView permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page.
Note that this also affects GraphQL queries which have a limit applied, even if the query isn’t paginated per se.
This has been fixed by ensuring no new records are pulled in from the database after performing canView permission checks for each page of results. This may result in some pages in your query results having less than the maximum number of records per page even when there are more pages of results.
This behaviour is consistent with how pagination works in other areas of Silverstripe CMS, such as in GridField, and is a result of having to perform permission checks in PHP rather than in the database directly.
You can choose to disable these permission checks by disabling the CanViewPermission plugin following the instructions in overriding default plugins.
Note that this vulnerability does not affect version 3.x.
Base CVSS: 5.3 Reported by: Eduard Briem from Hothouse Creative, Nelson
References
https://www.silverstripe.org/download/security-releases/CVE-2023-44401
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/graphql"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.3.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "silverstripe/graphql"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-44401"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-23T12:49:10Z",
"nvd_published_at": "2024-01-23T14:15:37Z",
"severity": "MODERATE"
},
"details": "### Impact\n`canView` permission checks are bypassed for ORM data in paginated GraphQL query results where the total number of records is greater than the number of records per page.\n\nNote that this also affects GraphQL queries which have a limit applied, even if the query isn\u2019t paginated per se.\n\nThis has been fixed by ensuring no new records are pulled in from the database after performing `canView` permission checks for each page of results. This may result in some pages in your query results having less than the maximum number of records per page even when there are more pages of results.\n\nThis behaviour is consistent with how pagination works in other areas of Silverstripe CMS, such as in `GridField`, and is a result of having to perform permission checks in PHP rather than in the database directly.\n\nYou can choose to disable these permission checks by disabling the `CanViewPermission` plugin following the instructions in [overriding default plugins](https://docs.silverstripe.org/en/5/developer_guides/graphql/plugins/overview/#overriding-default-plugins).\n\nNote that this vulnerability does not affect version 3.x.\n\n**Base CVSS:** [5.3](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C\u0026version=3.1)\n**Reported by:** Eduard Briem from Hothouse Creative, Nelson\n\n### References\nhttps://www.silverstripe.org/download/security-releases/CVE-2023-44401\n",
"id": "GHSA-jgph-w8rh-xf5p",
"modified": "2024-01-29T14:22:17Z",
"published": "2024-01-23T12:49:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/silverstripe/silverstripe-graphql/security/advisories/GHSA-jgph-w8rh-xf5p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-44401"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/silverstripe/graphql/CVE-2023-44401.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/silverstripe/silverstripe-graphql"
},
{
"type": "WEB",
"url": "https://www.silverstripe.org/download/security-releases/CVE-2023-44401"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "View permissions are bypassed for paginated lists of ORM data"
}
GHSA-JGPJ-VFXG-97H5
Vulnerability from github – Published: 2023-12-01 09:30 – Updated: 2023-12-01 09:30An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.
{
"affected": [],
"aliases": [
"CVE-2023-5995"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-01T07:15:13Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab EE affecting all versions starting from 16.2 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for an attacker to abuse the policy bot to gain access to internal projects.",
"id": "GHSA-jgpj-vfxg-97h5",
"modified": "2023-12-01T09:30:44Z",
"published": "2023-12-01T09:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5995"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/2138880"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/425361"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.