The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Web applications susceptible to direct request attacks often make the false assumption that such resources can only be reached through a given navigation path and so only apply authorization at certain points in the path.

Primary

forced browsing
The "forced browsing" term could be misinterpreted to include weaknesses such as CSRF or XSS, so its use is discouraged.

Implementation

Operation

Confidentiality
Integrity
Availability
Access Control
Read Application Data
Modify Application Data
Execute Unauthorized Code or Commands
Gain Privileges or Assume Identity

Architecture and Design
Operation
Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.

Architecture and Design
Consider using MVC based frameworks such as Struts.

If forced browsing is possible, an attacker may be able to directly access a sensitive page by entering a URL similar to the following.

http://somesite.com/someapplication/admin.jsp

CVE-2022-29238
Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
https://www.cve.org/CVERecord?id=CVE-2022-29238

CVE-2022-23607
Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect.
https://www.cve.org/CVERecord?id=CVE-2022-23607

CVE-2004-2144
Bypass authentication via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-2144

CVE-2005-1892
Infinite loop or infoleak triggered by direct requests.
https://www.cve.org/CVERecord?id=CVE-2005-1892

CVE-2004-2257
Bypass auth/auth via direct request.
https://www.cve.org/CVERecord?id=CVE-2004-2257

CVE-2005-1688
Direct request leads to infoleak by error.
https://www.cve.org/CVERecord?id=CVE-2005-1688

CVE-2005-1697
Direct request leads to infoleak by error.
https://www.cve.org/CVERecord?id=CVE-2005-1697

CVE-2005-1698
Direct request leads to infoleak by error.
https://www.cve.org/CVERecord?id=CVE-2005-1698

CVE-2005-1685
Authentication bypass via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-1685

CVE-2005-1827
Authentication bypass via direct request.
https://www.cve.org/CVERecord?id=CVE-2005-1827

CVE-2005-1654
Authorization bypass using direct request.
https://www.cve.org/CVERecord?id=CVE-2005-1654

CVE-2005-1668
Access privileged functionality using direct request.
https://www.cve.org/CVERecord?id=CVE-2005-1668

CVE-2002-1798
Upload arbitrary files via direct request.
https://www.cve.org/CVERecord?id=CVE-2002-1798

Direct Request aka 'Forced Browsing'

A10
Failure to Restrict URL Access
CWE More Specific

A1
Unvalidated Input
CWE More Specific

A2
Broken Access Control
CWE More Specific

34
Predictable Resource Location

SFP30
Missing endpoint authentication

Allowed
This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Overlaps Modification of Assumed-Immutable Data (MAID), authorization errors, container errors; often primary to other weaknesses such as XSS and SQL injection.
"Forced browsing" is a step-based manipulation involving the omission of one or more steps, whose order is assumed to be immutable. The application does not verify that the first step was performed successfully before the second step. The consequence is typically "authentication bypass" or "path disclosure," although it can be primary to all kinds of weaknesses, especially in languages such as PHP, which allow external modification of assumed-immutable variables.

PLOVER
2006-07-19
Draft 3
2006-07-19

Sean Eidemiller
Cigital
2008-07-01
added/updated demonstrative examples

Eric Dalci
Cigital
2008-07-01
updated Potential_Mitigations, Time_of_Introduction

Veracode
2008-08-15
Suggested OWASP Top Ten 2004 mapping

CWE Content Team
MITRE
2008-09-08
updated Alternate_Terms, Relationships, Relationship_Notes, Taxonomy_Mappings, Theoretical_Notes

CWE Content Team
MITRE
2008-10-14
updated Description

CWE Content Team
MITRE
2010-02-16
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2011-03-29
updated Applicable_Platforms, Description, Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences, Relationships

CWE Content Team
MITRE
2012-05-11
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-07-30
updated Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2017-11-08
updated Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2018-03-27
updated Relationships

CWE Content Team
MITRE
2019-06-20
updated Relationships

CWE Content Team
MITRE
2020-02-24
updated Applicable_Platforms, Relationships

CWE Content Team
MITRE
2021-07-20
updated Related_Attack_Patterns

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Observed_Examples, Related_Attack_Patterns

CWE Content Team
MITRE
2023-04-27
updated Modes_of_Introduction, Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Relationships, Weakness_Ordinalities