CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7172 vulnerabilities reference this CWE, most recent first.
GHSA-PQWR-PHVV-V49F
Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2026-09-02 20:49Withdrawn Advisory
This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references.
Original Description
In open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint http://0.0.0.0:8080/api/v1/users/{uuid_administrator}. This action is restricted by the user interface but can be performed through direct API calls.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.3.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-7039"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T17:29:56Z",
"nvd_published_at": "2025-03-20T10:15:35Z",
"severity": "HIGH"
},
"details": "### Withdrawn Advisory\nThis advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references.\n\n### Original Description\nIn open-webui/open-webui version v0.3.8, there is an improper privilege management vulnerability. The application allows an attacker, acting as an admin, to delete other administrators via the API endpoint `http://0.0.0.0:8080/api/v1/users/{uuid_administrator}`. This action is restricted by the user interface but can be performed through direct API calls.",
"id": "GHSA-pqwr-phvv-v49f",
"modified": "2026-09-02T20:49:28Z",
"published": "2025-03-20T12:32:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7039"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
},
{
"type": "WEB",
"url": "https://huntr.com/bounties/27fc8a5a-546e-4cf2-8edb-df42e36518fc"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"type": "CVSS_V3"
}
],
"summary": "Withdrawn Advisory: Open WebUI Allows Admin Deletion via API Endpoint",
"withdrawn": "2026-09-02T20:49:28Z"
}
GHSA-PR32-4GHW-RWCV
Vulnerability from github – Published: 2026-03-11 18:30 – Updated: 2026-05-13 18:30Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future.
{
"affected": [],
"aliases": [
"CVE-2026-1497"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-11T16:16:22Z",
"severity": "LOW"
},
"details": "Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario:\u00a0\nan admin that intends to give a user an access to a remote database constituent \"namespace.name\" will inadvertently grant access to any local database or remote alias called \"name\". If such database or alias doesn\u0027t exist when the command is run, the privileges will apply if it\u0027s created in the future.",
"id": "GHSA-pr32-4ghw-rwcv",
"modified": "2026-05-13T18:30:31Z",
"published": "2026-03-11T18:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1497"
},
{
"type": "WEB",
"url": "https://neo4j.com/security/CVE-2026-1497"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:D/RE:M/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-PR6H-VR44-XQ8J
Vulnerability from github – Published: 2026-09-18 17:59 – Updated: 2026-09-18 17:59Summary
In affected versions, enabling registry authentication (OBOT_SERVER_ENABLE_REGISTRY_AUTH=true) does not actually protect the MCP Registry endpoints under /v0.1/* — they remain readable by unauthenticated callers.
Am I affected?
You are affected if you run Obot <= v0.22.1 with OBOT_SERVER_ENABLE_REGISTRY_AUTH=true. An unauthenticated GET /v0.1/servers returns 200 OK with catalog server metadata. (With registry auth disabled, the registry is intentionally public and this is not a defect.)
Details
The authorizer rejects a fixed set of known-protected prefixes and then default-allows everything else. The registry is mounted at the top-level /v0.1 prefix, which was not in that set, so anonymous requests were authorized before the WWW-Authenticate challenge for /v0.1 was ever reached. The registry handler still applies its own per-user ACR filtering, so an anonymous caller receives only entries accessible to the anonymous identity (e.g. default-catalog/wildcard entries), and responses contain names, descriptions, repository URLs, icons, and connect URLs — not secret env/header values. This is the same root cause as GHSA-vw82-7fv8-r6gp, whose fix protected /mcp-connect/ but not the /v0.1 registry prefix.
Impact
Worst case is disclosure of the registry server inventory (names, descriptions, repository URLs, connect URLs) that the operator explicitly chose to put behind authentication. No credential values are exposed and unauthenticated users cannot connect to the servers because connecting is properly protected by auth.
Mitigation
Upgrade to v0.23.0 or later, in which the /v0.1 registry prefix is treated as a protected route so authentication is enforced for unauthenticated callers.
Severity
CVSS v3.1 Score: 5.3/10 (Medium) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Credits
The Obot team would like to thank HE WEI（ギカク）(https://www.linkedin.com/in/gikaku, @hewei-gikaku) for responsibly disclosing this issue in accordance with our security policy.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/obot-platform/obot"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-18T17:59:40Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n\nIn affected versions, enabling registry authentication (`OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`) does not actually protect the MCP Registry endpoints under `/v0.1/*` \u2014 they remain readable by unauthenticated callers.\n\n## Am I affected?\n\nYou are affected if you run Obot `\u003c= v0.22.1` with `OBOT_SERVER_ENABLE_REGISTRY_AUTH=true`. An unauthenticated `GET /v0.1/servers` returns `200 OK` with catalog server metadata. (With registry auth disabled, the registry is intentionally public and this is not a defect.)\n\n## Details\n\nThe authorizer rejects a fixed set of known-protected prefixes and then default-allows everything else. The registry is mounted at the top-level `/v0.1` prefix, which was not in that set, so anonymous requests were authorized before the `WWW-Authenticate` challenge for `/v0.1` was ever reached. The registry handler still applies its own per-user ACR filtering, so an anonymous caller receives only entries accessible to the anonymous identity (e.g. default-catalog/wildcard entries), and responses contain names, descriptions, repository URLs, icons, and connect URLs \u2014 not secret env/header values. This is the same root cause as GHSA-vw82-7fv8-r6gp, whose fix protected `/mcp-connect/` but not the `/v0.1` registry prefix.\n\n## Impact\n\nWorst case is disclosure of the registry server inventory (names, descriptions, repository URLs, connect URLs) that the operator explicitly chose to put behind authentication. No credential values are exposed and unauthenticated users cannot connect to the servers because connecting is properly protected by auth.\n\n## Mitigation\n\nUpgrade to **v0.23.0** or later, in which the `/v0.1` registry prefix is treated as a protected route so authentication is enforced for unauthenticated callers.\n\n## Severity\n\nCVSS v3.1 Score: **5.3/10 (Medium)** \u2014 `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`\n\n## Credits\n\nThe Obot team would like to thank HE WEI\uff08\u30ae\u30ab\u30af\uff09(https://www.linkedin.com/in/gikaku, [@hewei-gikaku](https://github.com/hewei-gikaku)) for responsibly disclosing this issue in accordance with our [security policy](https://github.com/obot-platform/obot/?tab=security-ov-file).",
"id": "GHSA-pr6h-vr44-xq8j",
"modified": "2026-09-18T17:59:41Z",
"published": "2026-09-18T17:59:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/obot-platform/obot/security/advisories/GHSA-pr6h-vr44-xq8j"
},
{
"type": "PACKAGE",
"url": "https://github.com/obot-platform/obot"
},
{
"type": "WEB",
"url": "https://github.com/obot-platform/obot/releases/tag/v0.23.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Obot: MCP Registry API readable without authentication"
}
GHSA-PR8C-FV23-2J59
Vulnerability from github – Published: 2025-02-01 00:31 – Updated: 2025-02-03 18:30macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state.
{
"affected": [],
"aliases": [
"CVE-2024-57433"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-31T22:15:12Z",
"severity": "HIGH"
},
"details": "macrozheng mall-tiny 1.0.1 is vulnerable to Incorrect Access Control via the logout function. After a user logs out, their token is still available and fetches information in the logged-in state.",
"id": "GHSA-pr8c-fv23-2j59",
"modified": "2025-02-03T18:30:40Z",
"published": "2025-02-01T00:31:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57433"
},
{
"type": "WEB",
"url": "https://github.com/peccc/restful_vul/blob/main/mall_tiny_logout_failed/mall_tiny_logout_failed.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PR8C-JQC3-9GWW
Vulnerability from github – Published: 2022-05-24 17:27 – Updated: 2022-05-24 17:27u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Bitra, Nicobar, QCS605, QCS610, Rennell, SA6155P, Saipan, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
{
"affected": [],
"aliases": [
"CVE-2019-10596"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-08T10:15:00Z",
"severity": "HIGH"
},
"details": "u\u0027Improper access control can lead signed process to guess pid of other processes and access their address space\u0027 in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Bitra, Nicobar, QCS605, QCS610, Rennell, SA6155P, Saipan, SC7180, SC8180X, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130",
"id": "GHSA-pr8c-jqc3-9gww",
"modified": "2022-05-24T17:27:29Z",
"published": "2022-05-24T17:27:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10596"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/august-2020-bulletin"
},
{
"type": "WEB",
"url": "https://www.qualcomm.com/company/product-security/bulletins/august-2020-security-bulletin"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PR8J-WGF3-MGRX
Vulnerability from github – Published: 2022-05-24 17:08 – Updated: 2022-05-24 17:08When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical access to an authorized user's machine can get shell access under unprivileged user.
{
"affected": [],
"aliases": [
"CVE-2020-5855"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-02-06T16:15:00Z",
"severity": "MODERATE"
},
"details": "When the Windows Logon Integration feature is configured for all versions of BIG-IP Edge Client for Windows, unauthorized users who have physical access to an authorized user\u0027s machine can get shell access under unprivileged user.",
"id": "GHSA-pr8j-wgf3-mgrx",
"modified": "2022-05-24T17:08:10Z",
"published": "2022-05-24T17:08:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-5855"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K55102004"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-PRF5-97WH-VPMP
Vulnerability from github – Published: 2022-08-19 00:00 – Updated: 2022-08-23 00:00Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2021-37409"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-08-18T20:15:00Z",
"severity": "HIGH"
},
"details": "Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.",
"id": "GHSA-prf5-97wh-vpmp",
"modified": "2022-08-23T00:00:18Z",
"published": "2022-08-19T00:00:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37409"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2023/04/msg00002.html"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-PRG4-487R-RR8W
Vulnerability from github – Published: 2024-08-22 18:31 – Updated: 2024-11-06 18:31An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.
{
"affected": [],
"aliases": [
"CVE-2024-42773"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-22T18:15:10Z",
"severity": "CRITICAL"
},
"details": "An Incorrect Access Control vulnerability was found in /admin/edit_room_controller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section.",
"id": "GHSA-prg4-487r-rr8w",
"modified": "2024-11-06T18:31:05Z",
"published": "2024-08-22T18:31:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42773"
},
{
"type": "WEB",
"url": "https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Hotel%20Management%20System%20v1.0/Broken%20Access%20Control%20-%20Edit%20Room%20Entry.pdf"
},
{
"type": "WEB",
"url": "https://www.kashipara.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRM2-47W6-22X5
Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-12 00:01Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.
{
"affected": [],
"aliases": [
"CVE-2022-1224"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-04T11:15:00Z",
"severity": "MODERATE"
},
"details": "Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6.",
"id": "GHSA-prm2-47w6-22x5",
"modified": "2022-04-12T00:01:00Z",
"published": "2022-04-05T00:00:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1224"
},
{
"type": "WEB",
"url": "https://github.com/phpipam/phpipam/commit/f6a49fd9f93b7d7e0a4fbf1d35338502eed35953"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/cd9e1508-5682-427e-a921-14b4f520b85a"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-PRR9-9MP4-5GP2
Vulnerability from github – Published: 2026-07-21 21:49 – Updated: 2026-07-21 21:49Summary
PR #38145 fixed ListPublicMembers and IsPublicMember but missed ListMembers. Any authenticated user can enumerate ALL members (not just public ones) of a private organization.
Affected Versions
<= v1.26.4 (latest) and main branch
Root Cause
routers/api/v1/org/member.go — ListMembers():
// Missing check: if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }
Proof of Concept
Setup: privateorg (private), alice = member, bob = outsider
Bob lists ALL members of private org
curl -s "http://gitea/api/v1/orgs/privateorg/members" \ -H "Authorization: token BOB_TOKEN"
Result: HTTP 200
[{"login":"alice","email":"alice@test.com",...}]
Expected: HTTP 404
Note
This is an incomplete fix variant of PR #38145. That PR fixed public_members endpoints only. ListMembers (/orgs/{org}/members) remains unpatched.
Fix
Add to ListMembers(): if !organization.HasOrgOrUserVisible(ctx, ctx.Org.Organization.AsUser(), ctx.Doer) { ctx.APIErrorNotFound() return }
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "gitea.dev"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-58427"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-21T21:49:00Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\nPR #38145 fixed ListPublicMembers and IsPublicMember but missed \nListMembers. Any authenticated user can enumerate ALL members \n(not just public ones) of a private organization.\n\n## Affected Versions\n\u003c= v1.26.4 (latest) and main branch\n\n## Root Cause\nrouters/api/v1/org/member.go \u2014 ListMembers():\n\n// Missing check:\nif !organization.HasOrgOrUserVisible(ctx, \n ctx.Org.Organization.AsUser(), ctx.Doer) {\n ctx.APIErrorNotFound()\n return\n}\n\n## Proof of Concept\n\n# Setup: privateorg (private), alice = member, bob = outsider\n\n# Bob lists ALL members of private org\ncurl -s \"http://gitea/api/v1/orgs/privateorg/members\" \\\n -H \"Authorization: token BOB_TOKEN\"\n\n# Result: HTTP 200\n[{\"login\":\"alice\",\"email\":\"alice@test.com\",...}]\n# Expected: HTTP 404\n\n## Note\nThis is an incomplete fix variant of PR #38145.\nThat PR fixed public_members endpoints only.\nListMembers (/orgs/{org}/members) remains unpatched.\n\n## Fix\nAdd to ListMembers():\nif !organization.HasOrgOrUserVisible(ctx, \n ctx.Org.Organization.AsUser(), ctx.Doer) {\n ctx.APIErrorNotFound()\n return\n}",
"id": "GHSA-prr9-9mp4-5gp2",
"modified": "2026-07-21T21:49:00Z",
"published": "2026-07-21T21:49:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-prr9-9mp4-5gp2"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-gitea/gitea"
},
{
"type": "WEB",
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.27.0"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Gitea: Private org member list leaked via /members API endpoint \u2014 incomplete fix for PR #38145"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.