CWE-284: Improper Access Control

Extended Description

Access control involves the use of several protection mechanisms such as: Authentication (proving the identity of an actor) Authorization (ensuring that a given actor can access a resource), and Accountability (tracking of activities that were performed) When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses: Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator. Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.

Code Examples & CVEs

Demonstrative Examples

This code temporarily raises the program's privileges to allow creation of a new user folder.

While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.

BadPython

def makeNewUserDir(username):                         if invalidUsername(username):                                                                                                   #avoid CWE-22 and CWE-78                                  print('Usernames cannot contain invalid characters')return False                                                        try:raisePrivileges()os.mkdir('/home/' + username)lowerPrivileges()                            except OSError:print('Unable to create new user directory for user:' + username)return False                            return True

This function runs an arbitrary SQL query on a given database, returning the result of the query.

While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.

BadPHP

function runEmployeeQuery($dbName, $name){mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName);                         //Use a prepared statement to avoid CWE-89                         $preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name');$preparedStatement->execute(array(':name' => $name));return $preparedStatement->fetchAll();}                      /.../                                            $employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);

Observed CVE Examples (10)

CVE-2023-26463

Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)

View Details

CVE-2022-24985

A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms

View Details

CVE-2022-29238

Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.

View Details

CVE-2022-23607

Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect

View Details

CVE-2021-21972

Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.

View Details

CVE-2021-37415

IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.

View Details

CVE-2021-35033

Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port

View Details

CVE-2020-10263

Bluetooth speaker does not require authentication for the debug functionality on the UART port, allowing root shell access

View Details

CVE-2020-13927

Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.

View Details

CVE-2010-4624

Bulletin board applies restrictions on number of images during post creation, but does not enforce this on editing.

View Details

Source-backed guidance

Additional facts reviewed against primary or authoritative security sources.

Combine review and analysis around the CWE-284 trust boundary

CWE-284 is a high-level access-control pillar, so detection begins by mapping the finding to its concrete child weakness and intended policy. Use them to decompose the high-level access-control pillar into concrete authentication, authorization, ownership, and privilege rules, then test enforcement at each resource boundary. Require a reproducible source-to-sink or policy-to-enforcement trace, record coverage gaps, and confirm suspected findings dynamically where safe; no single scanner can establish complete coverage for this weakness.

CWE-284: detection methods and operational guidance — MITRE CWE

Apply deny-by-default access control at every trust boundary

Inventory protected resources and operations, then enforce a server-side, deny-by-default policy using least privilege. Separate authentication from authorization, prevent identifier manipulation from selecting another user’s object, constrain cross-origin access, and log failures. Map broad CWE-284 findings to a more precise child weakness when the missing or incorrect control is known.

OWASP Top 10:2025 A01 Broken Access Control — OWASP Foundation

Apply lessons from CVE-2025-31125 in Vite development server

NVD maps CVE-2025-31125 to CWE-284; improper access control exposed content from files outside the allowed set through crafted import query combinations when the development server was network-accessible. Use the case to keep development servers off untrusted networks and test every query-form variant against the same canonical file-authorization policy.

CVE-2025-31125 Detail — NIST National Vulnerability Database

Prioritize CWE-284 using its 2025 CWE Top 25 evidence

CWE-284 ranked #19 in the 2025 CWE Top 25 with a score of 4.07. The ranking table recorded 1 mapped vulnerability in CISA KEV for this measurement window. Use the rank to prioritize systemic prevention, detection coverage, and recurring-root-cause metrics across the portfolio, while retaining asset exposure and business impact for individual finding severity decisions.

2025 CWE Top 25 Most Dangerous Software Weaknesses — MITRE CWE

Exercise access control across every resource and operation

Define the permitted user, resource, operation, and contextual attributes for each authorization decision. Deny access by default, enforce least privilege, and validate permission on every request through a centralized control. Test horizontal and vertical privilege boundaries, alternate methods, direct identifiers, and non-browser clients so an overlooked path cannot bypass the intended policy.

Authorization Cheat Sheet — OWASP Foundation

Frequently Asked Questions

What is CWE-284: Improper Access Control?+

CWE-284: Improper Access Control is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Access control involves the use of several protection mechanisms such as: Authentication (proving the identity of an actor) Authorization (ensuring that a given actor can access a resource), and Accountability (tracking of activities that were performed) When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses: Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator. Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.

What are the security consequences of Improper Access Control?+

If exploited, CWE-284 (Improper Access Control) it can compromise Other, leading to outcomes such as Varies by Context.

Which programming languages are affected by Improper Access Control?+

CWE-284 commonly affects Not Language-Specific. Note that weaknesses are often language-agnostic patterns, so secure coding practices apply broadly.

What are real-world examples of Improper Access Control?+

MITRE documents real CVEs mapped to CWE-284, including CVE-2023-26463, CVE-2022-24985, CVE-2022-29238, CVE-2022-23607 and CVE-2021-21972. You can look up the full details of each CVE, including CVSS scores and remediation guidance, on our CVE Lookup tool.

What is the difference between a CWE and a CVE?+

A CWE (Common Weakness Enumeration) like CWE-284 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.

CWE-284: Improper Access Control

Extended Description

Technical Details

Applicable To

Security Consequences

Scope

Impact

Mitigation Strategies

Detection Methods

Code Examples & CVEs

Demonstrative Examples

Observed CVE Examples (10)

CWE Relationships

Source-backed guidance

Combine review and analysis around the CWE-284 trust boundary

Apply deny-by-default access control at every trust boundary

Apply lessons from CVE-2025-31125 in Vite development server

Prioritize CWE-284 using its 2025 CWE Top 25 evidence

Exercise access control across every resource and operation

Frequently Asked Questions

Learn More