Improper Access Control
CWE-284: Improper Access Control
Improper access control is the broad category for failing to restrict access to a resource to the right actors. It covers authentication, authorization, and accountability problems together and sits above more specific entries such as missing authorization, incorrect authorization, and missing authentication. When it appears in vulnerability data it often describes devices and services that expose management functions or data with no meaningful restriction at all.
Ranks change between editions as the underlying CVE data changes, so exam questions rarely hinge on an exact rank. Know what each weakness is, how it is exploited, and how it is prevented.
How it shows up in the real world
- A SaaS admin console lets any authenticated tenant user reach another tenant's billing settings because access is restricted by UI navigation only, not by any server-side rule.
- A cloud storage bucket holding customer records is readable by anyone with the URL.
- An internal debugging service bound to all interfaces lets anyone on the network change application state.
How to mitigate it
- Apply least privilege to every resource and define who may access it, from where, and with what rights.
- Restrict management interfaces to dedicated networks or VPNs and require strong authentication on them.
- Review cloud resource policies and default permissions continuously with automated posture checks.
- Map findings to the more specific child weakness so fixes target the actual failure.
Go deeper
Practice this topic
Test your knowledge of Improper Access Control with exam-style practice questions.