CWE-284 is Improper Access Control. The flaw arises when the product fails to restrict access to a resource, or restricts it incorrectly, for an unauthorized actor. The database currently holds 1,014 vulnerabilities mapped to CWE-284 and 4 of them are in the CISA Known Exploited Vulnerabilities catalog.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Access control involves the use of several protection mechanisms such as:
Authentication (proving the identity of an actor)
Authorization (ensuring that a given actor can access a resource), and
Accountability (tracking of activities that were performed)
There are two distinct behaviors that can introduce access control weaknesses:
Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
Access control relies on several related mechanisms: authentication establishes an actor's identity, authorization determines which resources that actor may access, and accountability tracks performed activities. A weakness can arise in the specified policy or configuration, such as overly broad permissions or ownership, or in enforcement, when the implementation fails to apply the policy correctly. Thus, a product may be insecure because excessive privileges were assigned at configuration time, or because its code allows users to define their own privileges or interprets invalid access-control data insecurely.
This weakness has two principal forms. Specification problems occur when privileges, permissions, or ownership are incorrectly assigned, such as making a resource writable by everyone or granting administrative capabilities to a guest. Enforcement problems occur when the mechanism fails to enforce the intended policy, such as allowing a user to specify their own privileges or allowing a syntactically incorrect access-control list to produce insecure settings. Access control encompasses mechanisms for authenticating actors, authorizing resource access, and maintaining accountability for activity.
Impact varies by context. When an access-control mechanism is missing or fails, an attacker may gain privileges or assume an identity, read sensitive information, execute commands, evade detection, or otherwise compromise product security.
| Impact | Scope | Explanation |
|---|---|---|
| Varies by Context, Gain Privileges or Assume Identity | Other | When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. |
Privilege management: Carefully manage how privileges are set, administered, and handled, and explicitly define trust zones in the software. Separation of privilege: Build clear security compartments and keep sensitive data within the relevant trust boundary. Use compartmentalization to reinforce privilege separation, and apply least privilege by using elevated privileges only when needed and dropping them as soon as they are no longer required.
The official CWE record does not specify a detection method for this weakness.
The following are representative examples, not an exhaustive list of vulnerabilities in this CWE:
CVE-2023-26463: reusing one variable for multiple purposes within a function led to incorrect access control, as part of a chain that also included an expired pointer dereference.CVE-2022-24985: a form-hosting website checked session authentication for only one form, allowing authentication bypass when multiple forms were present.CVE-2022-29238: a web-based document collaboration tool prevented listing hidden directories but did not prevent direct requests for files within them.CVE-2022-23607: a Python HTTP library failed to scope cookies to a particular domain, allowing them to be sent to any domain on redirect.CVE-2021-21972: a cloud virtualization platform allowed an unauthenticated file upload and then processed .. path traversal sequences to access unexpected files.CVE-2021-37415 and CVE-2020-13927: some REST API requests, or all API requests under a default setting, could be made without authentication.CVE-2021-35033 and CVE-2020-10263: a hard-coded password or unauthenticated UART debugging functionality enabled access to a highly privileged shell.CVE-2010-4624: the product limited the number of images during post creation but failed to enforce the same limit during editing.Below are representative vulnerabilities related to this CWE, prioritized by severity.
CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Review CyStack's security rating and practical recommendations for websites and edge assets.
Explore cybersecurity research from our team of security specialists.
Browse practical cybersecurity knowledge across CyStack's articles and guides.
en
