CWE - CWE-284: Improper Access Control (4.20)
Home > CWE List > CWE-284: Improper Access Control (4.20)  
ID
  • Home
  • Who We Are User Stories History Documents Videos
  • Basics
    Root Cause Mapping   ►
    Guidance Quick Tips Examples
    How to Contribute Weakness Content FAQs Glossary
  • Top-N Lists   ►
    Top 25 Software Top Hardware Top 10 KEV Weaknesses
    CWE List   ►
    Current Version Reports Visualizations Releases Archive
    Downloads REST API
  • News   ►
    Current News Blog Podcast News Archive
    CWE Board Working Groups & Special Interest Groups Email Lists
  • Search CWE List Search Website

    CWE-284: Improper Access Control

    Weakness ID: 284
    Vulnerability Mapping: DISCOURAGED This CWE ID should not be used to map to real-world vulnerabilities
    Abstraction: Pillar Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things.
    View customized information:
    For users who are interested in more notional aspects of a weakness. Example: educators, technical writers, and project/program managers. For users who are concerned with the practical application and details about the nature of a weakness and how to prevent it from happening. Example: tool developers, security researchers, pen-testers, incident response analysts. For users who are mapping an issue to CWE/CAPEC IDs, i.e., finding the most appropriate CWE for a specific issue (e.g., a CVE record). Example: tool developers, security researchers. For users who wish to see all available information for the CWE/CAPEC entry. For users who want to customize what details are displayed.
    ×

    Edit Custom Filter


    + Description
    The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
    + Extended Description

    Access control involves the use of several protection mechanisms such as:

    • Authentication (proving the identity of an actor)
    • Authorization (ensuring that a given actor can access a resource), and
    • Accountability (tracking of activities that were performed)

    When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.

    There are two distinct behaviors that can introduce access control weaknesses:

    • Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
    • Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.
    + Alternate Terms
    Authorization
    The terms "access control" and "authorization" are often used interchangeably, although many people have distinct definitions. The CWE usage of "access control" is intended as a general term for the various mechanisms that restrict which users can access which resources, and "authorization" is more narrowly defined. It is unlikely that there will be community consensus on the use of these terms.
    + Common Consequences
    Section HelpThis table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
    Impact Details

    Varies by Context

    		Scope: Other

    + Potential Mitigations
    Phase(s) Mitigation

    Architecture and Design; Operation
    Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

    Architecture and Design

    Strategy: Separation of Privilege

    Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

    Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
    + Relationships
    Section Help This table shows the weaknesses and high level categories that are related to this weakness. These relationships are defined as ChildOf, ParentOf, MemberOf and give insight to similar items that may exist at higher and lower levels of abstraction. In addition, relationships such as PeerOf and CanAlsoBe are defined to show similar weaknesses that the user may want to explore.
    + Relevant to the view "Research Concepts" (View-1000)
    Nature Type ID Name
    MemberOf View View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). 1000 Research Concepts
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 269 Improper Privilege Management
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 282 Improper Ownership Management
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 285 Improper Authorization
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 286 Incorrect User Management
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 287 Improper Authentication
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 346 Origin Validation Error
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 749 Exposed Dangerous Method or Function
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 923 Improper Restriction of Communication Channel to Intended Endpoints
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1191 On-Chip Debug and Test Interface With Improper Access Control
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1220 Insufficient Granularity of Access Control
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1224 Improper Restriction of Write-Once Bit Fields
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1231 Improper Prevention of Lock Bit Modification
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1252 CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1259 Improper Restriction of Security Token Assignment
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1260 Improper Handling of Overlap Between Protected Memory Ranges
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1262 Improper Access Control for Register Interface
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 1263 Improper Physical Access Control
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1267 Policy Uses Obsolete Encoding
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1270 Generation of Incorrect Security Tokens
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1274 Improper Access Control for Volatile Memory Containing Boot Code
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1276 Hardware Child Block Incorrectly Connected to Parent System
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1280 Access Control Check Implemented After Asset is Accessed
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1283 Mutable Attestation or Measurement Reporting Data
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1290 Incorrect Decoding of Security Identifiers
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1292 Incorrect Conversion of Security Identifiers
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 1294 Insecure Security Identifier Mechanism
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1296 Incorrect Chaining or Granularity of Debug Components
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1311 Improper Translation of Security Attributes by Fabric Bridge
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1313 Hardware Allows Activation of Test or Debug Logic at Runtime
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1315 Improper Setting of Bus Controlling Capability in Fabric End-point
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1317 Improper Access Control in Fabric Bridge
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1320 Improper Protection for Outbound Error Messages and Alert Signals
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1323 Improper Management of Sensitive Trace Data
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 1334 Unauthorized Error Injection Can Degrade Hardware Redundancy
    + Relevant to the view "Architectural Concepts" (View-1008)
    Nature Type ID Name
    MemberOf Category Category - a CWE entry that contains a set of other entries that share a common characteristic. 1011 Authorize Actors
    + Relevant to the view "CISQ Data Protection Measures" (View-1340)
    Nature Type ID Name
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 285 Improper Authorization
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 287 Improper Authentication
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 288 Authentication Bypass Using an Alternate Path or Channel
    ParentOf Base Base - a weakness that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. 639 Authorization Bypass Through User-Controlled Key
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 862 Missing Authorization
    ParentOf Class Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. 863 Incorrect Authorization
    + Modes Of Introduction
    Section HelpThe different Modes of Introduction provide information about how and when this weakness may be introduced. The Phase identifies a point in the life cycle at which introduction may occur, while the Note provides a typical scenario related to introduction during the given phase.
    Phase Note
    Architecture and Design
    Implementation REALIZATION: This weakness is caused during implementation of an architectural security tactic.
    Operation
    + Applicable Platforms
    Section HelpThis listing shows possible areas for which the given weakness could appear. These may be for specific named Languages, Operating Systems, Architectures, Paradigms, Technologies, or a class of such platforms. The platform is listed along with how frequently the given weakness appears for that instance.
    Languages

    Class: Not Language-Specific (Often Prevalent)

    Technologies

    Class: Not Technology-Specific (Often Prevalent)

    Class: ICS/OT (Often Prevalent)

    Class: Web Based (Often Prevalent)

    + Demonstrative Examples

    Example 1


    This code temporarily raises the program's privileges to allow creation of a new user folder.

    (bad code)
    Example Language: Python 
    def makeNewUserDir(username):
    if invalidUsername(username):

    #avoid CWE-22 and CWE-78
    print('Usernames cannot contain invalid characters')
    return False

    try:
    raisePrivileges()
    os.mkdir('/home/' + username)
    lowerPrivileges()

    except OSError:
    print('Unable to create new user directory for user:' + username)
    return False

    return True

    While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.



    Example 2


    This function runs an arbitrary SQL query on a given database, returning the result of the query.

    (bad code)
    Example Language: PHP 
    function runEmployeeQuery($dbName, $name){
    mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName);
    //Use a prepared statement to avoid CWE-89
    $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name');
    $preparedStatement->execute(array(':name' => $name));
    return $preparedStatement->fetchAll();
    }
    /.../

    $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);

    While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.



    Example 3


    In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.

    Multiple vendors did not use any authentication or used client-side authentication for critical functionality in their OT products.



    + Selected Observed Examples

    Note: this is a curated list of examples for users to understand the variety of ways in which this weakness can be introduced. It is not a complete list of all CVEs that are related to this CWE entry.

    Reference Description
    Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)
    A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms
    Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
    Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect
    Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
    IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.
    Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port
    Bluetooth speaker does not require authentication for the debug functionality on the UART port, allowing root shell access
    Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.
    Bulletin board applies restrictions on number of images during post creation, but does not enforce this on editing.
    + Weakness Ordinalities
    Ordinality Description
    Primary
    (where the weakness exists independent of other weaknesses)
    + Affected Resources
    • File or Directory
    + Memberships
    Section HelpThis MemberOf Relationships table shows additional CWE Categories and Views that reference this weakness as a member. This information is often useful in understanding where a weakness fits within the context of external information sources.
    Nature Type ID Name
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 254 7PK - Security Features
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 723 OWASP Top Ten 2004 Category A2 - Broken Access Control
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 944 SFP Secondary Cluster: Access Management
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1031 OWASP Top Ten 2017 Category A5 - Broken Access Control
    MemberOf ViewView - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). 1340 CISQ Data Protection Measures
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1345 OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1369 ICS Supply Chain: IT/OT Convergence/Expansion
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1372 ICS Supply Chain: OT Counterfeit and Malicious Corruption
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1396 Comprehensive Categorization: Access Control
    MemberOf ViewView - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). 1435 Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses
    MemberOf CategoryCategory - a CWE entry that contains a set of other entries that share a common characteristic. 1436 OWASP Top Ten 2025 Category A01:2025 - Broken Access Control
    + Vulnerability Mapping Notes
    Usage DISCOURAGED
    (this CWE ID should not be used to map to real-world vulnerabilities)
    Reasons Frequent Misuse, Frequent Misinterpretation, Abstraction

    Rationale

    		CWE-284 is extremely high-level, a Pillar. Its name, "Improper Access Control," is often misused in low-information vulnerability reports [REF-1287] or by active use of the OWASP Top Ten, such as "A01:2021-Broken Access Control". It is not useful for trend analysis.

    Comments

    		Consider using descendants-284 that are more specific to the kind of access control involved.

    Suggestions

    CWE-ID Comment
    CWE-862 Missing Authorization
    CWE-863 Incorrect Authorization
    CWE-732 Incorrect Permission Assignment for Critical Resource
    CWE-306 Missing Authentication
    CWE-1390 Weak Authentication
    CWE-286 Incorrect User Management
    CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
    + Notes

    Maintenance

    This entry needs more work. Possible sub-categories include:

    • Trusted group includes undesired entities (partially covered by CWE-286)
    • Group can perform undesired actions
    • ACL parse error does not fail closed
    + Taxonomy Mappings
    Mapped Taxonomy Name Node ID Fit Mapped Node Name
    PLOVER Access Control List (ACL) errors
    WASC 2 Insufficient Authorization
    7 Pernicious Kingdoms Missing Access Control
    + References
    [REF-7] Michael Howard and David LeBlanc. "Writing Secure Code". Chapter 6, "Determining Appropriate Access Control" Page 171. 2nd Edition. Microsoft Press. 2002-12-04.
    <https://www.microsoftpressstore.com/store/writing-secure-code-9780735617223>.
    [REF-44] Michael Howard, David LeBlanc and John Viega. "24 Deadly Sins of Software Security". "Sin 17: Failure to Protect Stored Data." Page 253. McGraw-Hill. 2010.
    [REF-1287] MITRE. "Supplemental Details - 2022 CWE Top 25". Details of Problematic Mappings. 2022-06-28.
    <https://cwe.mitre.org/top25/archive/2022/2022_cwe_top25_supplemental.html#problematicMappingDetails>. (URL validated: 2024-11-17)
    [REF-1283] Forescout Vedere Labs. "OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management". 2022-06-20.
    <https://www.forescout.com/resources/ot-icefall-report/>.
    + Content History
    + Submissions
    Submission Date Submitter Organization
    2006-07-19
    (CWE Draft 3, 2006-07-19)     		PLOVER
    + Modifications
    Modification Date Modifier Organization
    2026-04-30
    (CWE 4.20, 2026-04-30)     		CWE Content Team MITRE
    updated Mapping_Notes
    2026-01-21
    (CWE 4.19.1, 2026-01-21)     		CWE Content Team MITRE
    updated Relationships
    2025-12-11
    (CWE 4.19, 2025-12-11)     		CWE Content Team MITRE
    updated Applicable_Platforms, Demonstrative_Examples, Mapping_Notes, Observed_Examples, References, Relationships, Weakness_Ordinalities
    2025-04-03
    (CWE 4.17, 2025-04-03)     		CWE Content Team MITRE
    updated Relationships
    2024-02-29
    (CWE 4.14, 2024-02-29)     		CWE Content Team MITRE
    updated Observed_Examples
    2023-10-26
    (CWE 4.13, 2023-10-26)     		CWE Content Team MITRE
    updated Observed_Examples
    2023-06-29
    (CWE 4.12, 2023-06-29)     		CWE Content Team MITRE
    updated Mapping_Notes
    2023-04-27
    (CWE 4.11, 2023-04-27)     		CWE Content Team MITRE
    updated Relationships
    2023-01-31
    (CWE 4.10, 2023-01-31)     		CWE Content Team MITRE
    updated Applicable_Platforms, Description, Observed_Examples, Relationships
    2022-10-13
    (CWE 4.9, 2022-10-13)     		CWE Content Team MITRE
    updated References
    2022-06-28
    (CWE 4.8, 2022-06-28)     		CWE Content Team MITRE
    updated Observed_Examples
    2021-10-28
    (CWE 4.6, 2021-10-28)     		CWE Content Team MITRE
    updated Relationships
    2021-07-20
    (CWE 4.5, 2021-07-20)     		CWE Content Team MITRE
    updated Observed_Examples
    2021-03-15
    (CWE 4.4, 2021-03-15)     		CWE Content Team MITRE
    updated Maintenance_Notes, Relationships
    2020-12-10
    (CWE 4.3, 2020-12-10)     		CWE Content Team MITRE
    updated Potential_Mitigations, Relationships
    2020-08-20
    (CWE 4.2, 2020-08-20)     		CWE Content Team MITRE
    updated Relationships
    2020-06-25
    (CWE 4.1, 2020-06-25)     		CWE Content Team MITRE
    updated Relationships
    2020-02-24
    (CWE 4.0, 2020-02-24)     		CWE Content Team MITRE
    updated Relationships, Taxonomy_Mappings, Type
    2019-06-20
    (CWE 3.3, 2019-06-20)     		CWE Content Team MITRE
    updated Related_Attack_Patterns, Relationships
    2019-01-03
    (CWE 3.2, 2019-01-03)     		CWE Content Team MITRE
    updated Related_Attack_Patterns
    2018-03-27
    (CWE 3.1, 2018-03-27)     		CWE Content Team MITRE
    updated References, Relationships
    2017-11-08
    (CWE 3.0, 2017-11-08)     		CWE Content Team MITRE
    updated Affected_Resources, Modes_of_Introduction, Observed_Examples, References, Relationships
    2015-12-07
    (CWE 2.9, 2015-12-07)     		CWE Content Team MITRE
    updated Relationships
    2014-07-30
    (CWE 2.8, 2014-07-31)     		CWE Content Team MITRE
    updated Relationships
    2014-06-23
    (CWE 2.7, 2014-06-23)     		CWE Content Team MITRE
    updated Relationships
    2014-02-18
    (CWE 2.6, 2014-02-19)     		CWE Content Team MITRE
    updated Related_Attack_Patterns, Relationships
    2012-10-30
    (CWE 2.3, 2012-10-30)     		CWE Content Team MITRE
    updated Potential_Mitigations
    2012-05-11
    (CWE 2.2, 2012-05-15)     		CWE Content Team MITRE
    updated References, Relationships
    2011-06-27
    (CWE 2.0, 2011-06-27)     		CWE Content Team MITRE
    updated Common_Consequences
    2011-06-01
    (CWE 1.13, 2011-06-01)     		CWE Content Team MITRE
    updated Common_Consequences
    2011-03-29
    (CWE 1.12, 2011-03-30)     		CWE Content Team MITRE
    updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships
    2011-03-24
    (CWE 1.12, 2011-03-30)     		CWE Content Team MITRE
    Changed name and description; clarified difference between "access control" and "authorization."
    2010-06-21
    (CWE 1.9, 2010-06-21)     		CWE Content Team MITRE
    updated Potential_Mitigations
    2010-02-16
    (CWE 1.8, 2010-02-16)     		CWE Content Team MITRE
    updated References, Taxonomy_Mappings
    2009-12-28
    (CWE 1.7, 2009-12-28)     		CWE Content Team MITRE
    updated Potential_Mitigations
    2009-07-27
    (CWE 1.5, 2009-07-27)     		CWE Content Team MITRE
    updated Alternate_Terms, Relationships
    2009-03-10
    (CWE 1.3, 2009-03-10)     		CWE Content Team MITRE
    updated Relationships
    2008-10-14
    (CWE 1.0.1, 2008-10-14)     		CWE Content Team MITRE
    updated Relationships
    2008-09-08
    (CWE 1.0, 2008-09-09)     		CWE Content Team MITRE
    updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings
    2008-07-01
    (CWE 1.0, 2008-09-09)     		Eric Dalci Cigital
    updated Time_of_Introduction
    + Previous Entry Names
    Change Date Previous Entry Name
    2011-03-29 Access Control (Authorization) Issues
    2008-09-09 Access Control Issues
    Page Last Updated: April 30, 2026