CWE-425: Direct Request ('Forced Browsing')

What is CWE-425?

CWE-425 is Direct Request ('Forced Browsing'). The flaw arises when The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files. The database currently holds 30 vulnerabilities mapped to CWE-425 and none of them are in the CISA Known Exploited Vulnerabilities catalog.

OWASP TOP 10:2025 RANK1 — A01:2025 — Broken Access Control
Related CVES (365 days)30
AbstractionBase
Likelihood of exploit-

Vulnerabilities mapped to CWE-425

30 vulnerabilities173% increase year over year

No data

No vulnerability data in CISA KEV for CWE-425

Official definition

ByMitre CWE

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Characteristics

Alternate terms

  • forced browsing — The "forced browsing" term could be misinterpreted to include weaknesses such as CSRF or XSS, so its use is discouraged.

Modes of introduction

  • Implementation: Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.
  • Operation

Common consequences

ImpactScopeExplanation
Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume IdentityConfidentiality, Integrity, Availability, Access Control-

Risk mitigations

  1. Architecture and Design, OperationApply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
  2. Architecture and DesignConsider using MVC based frameworks such as Struts.

Representative vulnerabilities

Below are representative vulnerabilities related to this CWE, prioritized by severity.

Sources (2)
MITRE CWE
CWE Terms of Use

CWE™ Program, operated by The MITRE Corporation. Copyright © 2006–2026, The MITRE Corporation. The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. CWE Terms of Use.

Learn more

Run an in-depth assessment with complete web risk management

CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.

Explore CyStack VulnScan
More resources & insights

Explore more resources from CyStack

Website security reports

Review CyStack's security rating and practical recommendations for websites and edge assets.

Learn more

CyStack research

Explore cybersecurity research from our team of security specialists.

Learn more

Cybersecurity knowledge

Browse practical cybersecurity knowledge across CyStack's articles and guides.

Learn more