The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Access control involves the use of several protection mechanisms such as:

Authentication (proving the identity of an actor)
Authorization (ensuring that a given actor can access a resource), and
Accountability (tracking of activities that were performed)

When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc.
There are two distinct behaviors that can introduce access control weaknesses:

Specification: incorrect privileges, permissions, ownership, etc. are explicitly specified for either the user or the resource (for example, setting a password file to be world-writable, or giving administrator capabilities to a guest user). This action could be performed by the program or the administrator.
Enforcement: the mechanism contains errors that prevent it from properly enforcing the specified access control requirements (e.g., allowing the user to specify their own privileges, or allowing a syntactically-incorrect ACL to produce insecure settings). This problem occurs within the program itself, in that it does not actually enforce the intended security policy that the administrator specifies.

Primary

Authorization
The terms "access control" and "authorization" are often used interchangeably, although many people have distinct definitions. The CWE usage of "access control" is intended as a general term for the various mechanisms that restrict which users can access which resources, and "authorization" is more narrowly defined. It is unlikely that there will be community consensus on the use of these terms.

Architecture and Design

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Operation

Other
Varies by Context

Architecture and Design
Operation
Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

Architecture and Design
Separation of Privilege

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.
Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

This code temporarily raises the program's privileges to allow creation of a new user folder.

def makeNewUserDir(username):
if invalidUsername(username):

#avoid CWE-22 and CWE-78
print('Usernames cannot contain invalid characters')return False

try:raisePrivileges()os.mkdir('/home/' + username)lowerPrivileges()
except OSError:print('Unable to create new user directory for user:' + username)return False
return True

While the program only raises its privilege level to create the folder and immediately lowers it again, if the call to os.mkdir() throws an exception, the call to lowerPrivileges() will not occur. As a result, the program is indefinitely operating in a raised privilege state, possibly allowing further exploitation to occur.

This function runs an arbitrary SQL query on a given database, returning the result of the query.

function runEmployeeQuery($dbName, $name){mysql_select_db($dbName,$globalDbHandle) or die("Could not open Database".$dbName);
//Use a prepared statement to avoid CWE-89
$preparedStatement = $globalDbHandle->prepare('SELECT * FROM employees WHERE name = :name');$preparedStatement->execute(array(':name' => $name));return $preparedStatement->fetchAll();}
/.../

$employeeRecord = runEmployeeQuery('EmployeeDB',$_GET['EmployeeName']);

While this code is careful to avoid SQL Injection, the function does not confirm the user sending the query is authorized to do so. An attacker may be able to obtain sensitive employee information from the database.

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
Multiple vendors did not use any authentication or used client-side authentication for critical functionality in their OT products.

CVE-2023-26463
Chain: IPSec VPN product uses the same variable for multiple purposes in the same function (CWE-1109), leading to incorrect access control (CWE-284) and expired pointer dereference (CWE-825)
https://www.cve.org/CVERecord?id=CVE-2023-26463

CVE-2022-24985
A form hosting website only checks the session authentication status for a single form, making it possible to bypass authentication when there are multiple forms
https://www.cve.org/CVERecord?id=CVE-2022-24985

CVE-2022-29238
Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
https://www.cve.org/CVERecord?id=CVE-2022-29238

CVE-2022-23607
Python-based HTTP library did not scope cookies to a particular domain such that "supercookies" could be sent to any domain on redirect
https://www.cve.org/CVERecord?id=CVE-2022-23607

CVE-2021-21972
Chain: Cloud computing virtualization platform does not require authentication for upload of a tar format file (CWE-306), then uses .. path traversal sequences (CWE-23) in the file to access unexpected files, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-21972

CVE-2021-37415
IT management product does not perform authentication for some REST API requests, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2021-37415

CVE-2021-35033
Firmware for a WiFi router uses a hard-coded password for a BusyBox shell, allowing bypass of authentication through the UART port
https://www.cve.org/CVERecord?id=CVE-2021-35033

CVE-2020-10263
Bluetooth speaker does not require authentication for the debug functionality on the UART port, allowing root shell access
https://www.cve.org/CVERecord?id=CVE-2020-10263

CVE-2020-13927
Default setting in workflow management product allows all API requests without authentication, as exploited in the wild per CISA KEV.
https://www.cve.org/CVERecord?id=CVE-2020-13927

CVE-2010-4624
Bulletin board applies restrictions on number of images during post creation, but does not enforce this on editing.
https://www.cve.org/CVERecord?id=CVE-2010-4624

File or Directory

Access Control List (ACL) errors

2
Insufficient Authorization

Missing Access Control

Discouraged
CWE-284 is extremely high-level, a Pillar. Its name, "Improper Access Control," is often misused in low-information vulnerability reports [REF-1287] or by active use of the OWASP Top Ten, such as "A01:2021-Broken Access Control". It is not useful for trend analysis.
Consider using descendants of CWE-284 that are more specific to the kind of access control involved, such as those involving authorization (Missing Authorization (CWE-862), Incorrect Authorization (CWE-863), Incorrect Permission Assignment for Critical Resource (CWE-732), etc.); authentication (Missing Authentication (CWE-306) or Weak Authentication (CWE-1390)); Incorrect User Management (CWE-286); Improper Restriction of Communication Channel to Intended Endpoints (CWE-923); etc.

This entry needs more work. Possible sub-categories include:

Trusted group includes undesired entities (partially covered by CWE-286)
Group can perform undesired actions
ACL parse error does not fail closed

PLOVER
2006-07-19
Draft 3
2006-07-19

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships, Taxonomy_Mappings

CWE Content Team
MITRE
2008-10-14
updated Relationships

CWE Content Team
MITRE
2009-03-10
updated Relationships

CWE Content Team
MITRE
2009-07-27
updated Alternate_Terms, Relationships

CWE Content Team
MITRE
2009-12-28
updated Potential_Mitigations

CWE Content Team
MITRE
2010-02-16
updated References, Taxonomy_Mappings

CWE Content Team
MITRE
2010-06-21
updated Potential_Mitigations

CWE Content Team
MITRE
2011-03-24
Critical
Changed name and description; clarified difference between "access control" and "authorization."

CWE Content Team
MITRE
2011-03-29
updated Alternate_Terms, Background_Details, Description, Maintenance_Notes, Name, Relationships

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated References, Relationships

CWE Content Team
MITRE
2012-10-30
updated Potential_Mitigations

CWE Content Team
MITRE
2014-02-18
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2014-06-23
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2015-12-07
updated Relationships

CWE Content Team
MITRE
2017-11-08
updated Affected_Resources, Modes_of_Introduction, Observed_Examples, References, Relationships

CWE Content Team
MITRE
2018-03-27
updated References, Relationships

CWE Content Team
MITRE
2019-01-03
updated Related_Attack_Patterns

CWE Content Team
MITRE
2019-06-20
updated Related_Attack_Patterns, Relationships

CWE Content Team
MITRE
2020-02-24
updated Relationships, Taxonomy_Mappings, Type

CWE Content Team
MITRE
2020-06-25
updated Relationships

CWE Content Team
MITRE
2020-08-20
updated Relationships

CWE Content Team
MITRE
2020-12-10
updated Potential_Mitigations, Relationships

CWE Content Team
MITRE
2021-03-15
updated Maintenance_Notes, Relationships

CWE Content Team
MITRE
2021-07-20
updated Observed_Examples

CWE Content Team
MITRE
2021-10-28
updated Relationships

CWE Content Team
MITRE
2022-06-28
updated Observed_Examples

CWE Content Team
MITRE
2022-10-13
updated References

CWE Content Team
MITRE
2023-01-31
updated Applicable_Platforms, Description, Observed_Examples, Relationships

CWE Content Team
MITRE
2023-04-27
updated Relationships

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2023-10-26
updated Observed_Examples

CWE Content Team
MITRE
2024-02-29
4.14
2024-02-29
updated Observed_Examples

CWE Content Team
MITRE
2025-04-03
4.17
2025-04-03
updated Relationships

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Demonstrative_Examples, Mapping_Notes, Observed_Examples, References, Relationships, Weakness_Ordinalities

CWE Content Team
MITRE
2026-01-21
4.19.1
2026-01-21
updated Relationships

Access Control Issues
Access Control (Authorization) Issues