CWE-425: Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Consequences

• Confidentiality, Integrity, Availability, Access Control: Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity

How to prevent it

• Architecture and Design, Operation: Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
• Architecture and Design: Consider using MVC based frameworks such as Struts.

Recent advisories

• GHSA-46xh-7854-f568 — Concrete CMS is vulnerable to authorization bypass in the Calendar Block
• GHSA-hm32-hfmw-rhvg — Keycloak has a Forced Browsing issue
• GHSA-53mr-6c8q-9789 — LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
• GHSA-g6pg-52vf-843h — MLFlow allows Tracing + Assessments Access
• GHSA-jxxm-27vp-c3m5 — NATS allows MQTT clients to bypass ACL checks
• GO-2026-4601 — Incorrect parsing of IPv6 host literals in net/url
• GHSA-h3vp-qwmx-5j25 — Grokability Snipe-IT has incorrect authorization for accessing asset information
• CVE-2024-45195 — Apache OFBiz: Confused controller-view authorization logic (forced browsing)
• GHSA-x5w2-wcr8-9q45 — Silverstripe Missing security check on dev/build/defaults
• GHSA-fc75-58r8-rm3h — Wagtail vulnerable to disclosure of user names via admin bulk action views
• GHSA-xph3-vjcq-g488 — Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions
• GHSA-6jfc-mc97-c7wg — Missing Authorization in Jenkins
• GHSA-pfrc-5hhq-6hvr — Showdoc Unauthenticated Access
• CVE-2021-26085 — Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability…
• GHSA-ff7x-qrg7-qggm — dot-prop Prototype Pollution vulnerability

All advisories for CWE-425