CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6734 vulnerabilities reference this CWE, most recent first.
GHSA-6JRF-4JV4-R9MW
Vulnerability from github – Published: 2025-04-09 13:01 – Updated: 2025-04-09 13:01Name: ISA-2025-003: Malicious validator can spoof votes from other validators Component: tendermint-rs Criticality: High (Catastrophic Impact; Rare Likelihood per ACMv1.2) Affected versions: <= v0.40.2 Affected users: Everyone
Description
tendermint-rs contains a critical vulnerability in its light client implementation due to insecure handling of corrupted validator sets. Because it doesn't check that the validator address is correctly derived from the validator's public key when counting votes, it is possible to spoof votes from other validators. The result is being able to construct the malicious block and cheat the light client. The light client will accept such a block, seemingly signed by 2/3+ majority.
Patches
The new tendermint-rs release v0.40.3 fixes this issue.
Unreleased code in the main branch is patched as well.
Workarounds
There are no known workarounds for this issue.
Timeline
- March 12, 2025, 13:41pm PST: Issue reported
- March 12, 2025, 03:00am PST: Core team completes validation of issue
This issue was reported by Felix Wilhelm from Asymmetric Research.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "tendermint-light-client-verifier"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.40.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-09T13:01:26Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "Name: ISA-2025-003: Malicious validator can spoof votes from other validators \nComponent: tendermint-rs\nCriticality: High (Catastrophic Impact; Rare Likelihood per [ACMv1.2](https://github.com/interchainio/security/blob/main/resources/CLASSIFICATION_MATRIX.md))\nAffected versions: \u003c= v0.40.2\nAffected users: Everyone\n\n### Description\n\ntendermint-rs contains a critical vulnerability in its light client implementation due to insecure handling of corrupted validator sets. Because it doesn\u0027t check that the validator address is correctly derived from the validator\u0027s public key when counting votes, it is possible to spoof votes from other validators. The result is being able to construct the malicious block and cheat the light client. The light client will accept such a block, seemingly signed by 2/3+ majority.\n\n### Patches\n\nThe new tendermint-rs release [v0.40.3](https://github.com/informalsystems/tendermint-rs/releases/tag/v0.40.3) fixes this issue.\n\nUnreleased code in the main branch is patched as well.\n\n### Workarounds\n\nThere are no known workarounds for this issue.\n\n### Timeline\n\n* March 12, 2025, 13:41pm PST: Issue reported\n* March 12, 2025, 03:00am PST: Core team completes validation of issue\n\nThis issue was reported by Felix Wilhelm from [Asymmetric Research](https://www.asymmetric.re/).",
"id": "GHSA-6jrf-4jv4-r9mw",
"modified": "2025-04-09T13:01:26Z",
"published": "2025-04-09T13:01:26Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/informalsystems/tendermint-rs/security/advisories/GHSA-6jrf-4jv4-r9mw"
},
{
"type": "WEB",
"url": "https://github.com/informalsystems/tendermint-rs/commit/1aabcfe6a3c0678db22097543f7f7a662f0db34b"
},
{
"type": "PACKAGE",
"url": "https://github.com/informalsystems/tendermint-rs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "tendermint-rs\u0027s Light Client Verifier allows malicious validators to spoof votes from other validators "
}
GHSA-6JVQ-7CJ3-36WH
Vulnerability from github – Published: 2022-05-24 16:46 – Updated: 2024-04-04 00:43The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.
{
"affected": [],
"aliases": [
"CVE-2019-3403"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-05-22T18:29:00Z",
"severity": "MODERATE"
},
"details": "The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.",
"id": "GHSA-6jvq-7cj3-36wh",
"modified": "2024-04-04T00:43:58Z",
"published": "2022-05-24T16:46:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3403"
},
{
"type": "WEB",
"url": "https://jira.atlassian.com/browse/JRASERVER-69242"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6JWJ-6H4R-9VR7
Vulnerability from github – Published: 2022-04-05 00:00 – Updated: 2022-04-14 00:00Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. This could result in a user disabling anti-tampering mechanisms which would then allow the user to disable Forcepoint One Endpoint and the protection offered by it.
{
"affected": [],
"aliases": [
"CVE-2022-27608"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-04T20:15:00Z",
"severity": "MODERATE"
},
"details": "Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. This could result in a user disabling anti-tampering mechanisms which would then allow the user to disable Forcepoint One Endpoint and the protection offered by it.",
"id": "GHSA-6jwj-6h4r-9vr7",
"modified": "2022-04-14T00:00:41Z",
"published": "2022-04-05T00:00:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-27608"
},
{
"type": "WEB",
"url": "https://help.forcepoint.com/security/CVE/CVE-2022-27608.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6JX2-3QQX-X2M4
Vulnerability from github – Published: 2025-01-21 21:30 – Updated: 2025-01-21 21:30Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Foundation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Foundation accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Foundation accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
{
"affected": [],
"aliases": [
"CVE-2025-21506"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T21:15:15Z",
"severity": "HIGH"
},
"details": "Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite (component: Technology Foundation). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project Foundation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Project Foundation accessible data as well as unauthorized access to critical data or complete access to all Oracle Project Foundation accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).",
"id": "GHSA-6jx2-3qqx-x2m4",
"modified": "2025-01-21T21:30:55Z",
"published": "2025-01-21T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21506"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6M3M-2Q88-9QC9
Vulnerability from github – Published: 2022-05-24 19:10 – Updated: 2022-07-13 00:00Improper access control in kernel mode driver for some Intel(R) NUC 9 Extreme Laptop Kits before version 2.2.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.
{
"affected": [],
"aliases": [
"CVE-2021-0196"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-11T13:15:00Z",
"severity": "HIGH"
},
"details": "Improper access control in kernel mode driver for some Intel(R) NUC 9 Extreme Laptop Kits before version 2.2.0.20 may allow an authenticated user to potentially enable escalation of privilege via local access.",
"id": "GHSA-6m3m-2q88-9qc9",
"modified": "2022-07-13T00:00:58Z",
"published": "2022-05-24T19:10:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0196"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00553.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6M72-467W-94RH
Vulnerability from github – Published: 2024-01-31 23:11 – Updated: 2024-01-31 23:11HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"events": [
{
"introduced": "1.2.0"
},
{
"fixed": "1.6.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/hashicorp/consul"
},
"ranges": [
{
"events": [
{
"introduced": "1.8.0"
},
{
"fixed": "1.8.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-28053"
],
"database_specific": {
"cwe_ids": [
"CWE-732",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-31T23:11:32Z",
"nvd_published_at": "2020-11-23T14:15:00Z",
"severity": "MODERATE"
},
"details": "HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.",
"id": "GHSA-6m72-467w-94rh",
"modified": "2024-01-31T23:11:32Z",
"published": "2024-01-31T23:11:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28053"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/pull/9240"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/commit/ff5215d882ac51b49c2647aac46b42aa9c890ce3"
},
{
"type": "WEB",
"url": "https://github.com/hashicorp/consul/blob/master/CHANGELOG.md#186-november-19-2020"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202208-09"
},
{
"type": "WEB",
"url": "https://www.hashicorp.com/blog/category/consul"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Privilege Escalation in HashiCorp Consul"
}
GHSA-6M7H-74WG-GQ59
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2022-07-15 00:00An issue has recently been discovered in Arista EOS where the incorrect use of EOS's AAA API’s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.
{
"affected": [],
"aliases": [
"CVE-2021-28501"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "HIGH"
},
"details": "An issue has recently been discovered in Arista EOS where the incorrect use of EOS\u0027s AAA API\u2019s by the OpenConfig and TerminAttr agents could result in unrestricted access to the device for local users with nopassword configuration.",
"id": "GHSA-6m7h-74wg-gq59",
"modified": "2022-07-15T00:00:16Z",
"published": "2022-01-15T00:01:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28501"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6MHR-52MV-6V6F
Vulnerability from github – Published: 2022-10-18 17:12 – Updated: 2022-10-18 17:12Impact
@keystone-6/core@2.2.0 || 2.3.0 users who are using the multiselect field, and provided field-level access control - are vulnerable to their field-level access control not being used.
List-level access control is NOT affected.
Field-level access control for fields other than multiselect are NOT affected.
Example, you are vulnerable if you are using field-level access control on a multiselect like the following:
const yourList = list({
access: {
// this is list-level access control, this is NOT impacted
},
fields: {
yourFieldName: multiselect({
// this is field-level access control, for multiselect fields
// this is vulnerable
access: {
create: ({ session }) => session?.data.isAdmin,
update: ({ session }) => session?.data.isAdmin,
},
options: [
{ value: 'apples', label: 'Apples' },
{ value: 'oranges', label: 'Oranges' },
],
// ...
}),
// ...
},
// ...
});
Mitigation
Please upgrade to @keystone-6/core >= 2.3.1, where this vulnerability has been closed.
Workarounds
If for some reason you cannot upgrade your dependencies, you should stop using the multiselect field.
Credits
Thanks to Marek R for reporting and submitting the pull request to fix this problem.
If you have any questions around this security advisory, please don't hesitate to contact us at security@keystonejs.com, or open an issue on GitHub.
If you have a security flaw to report for any software in this repository, please see our SECURITY policy.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@keystone-6/core"
},
"ranges": [
{
"events": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.3.1"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-39322"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-10-18T17:12:46Z",
"nvd_published_at": "2022-10-25T17:15:00Z",
"severity": "CRITICAL"
},
"details": "#### Impact\n\n`@keystone-6/core@2.2.0 || 2.3.0` users who are using the `multiselect` field, and provided field-level access control - are vulnerable to their field-level access control not being used.\n\nList-level access control is **NOT** affected.\n\nField-level access control for fields other than `multiselect` are **NOT** affected.\n\nExample, **you are vulnerable if** you are using field-level access control on a `multiselect` like the following:\n```ts\nconst yourList = list({\n access: {\n // this is list-level access control, this is NOT impacted\n },\n fields: {\n yourFieldName: multiselect({\n // this is field-level access control, for multiselect fields\n // this is vulnerable\n access: {\n create: ({ session }) =\u003e session?.data.isAdmin,\n update: ({ session }) =\u003e session?.data.isAdmin,\n },\n options: [\n { value: \u0027apples\u0027, label: \u0027Apples\u0027 },\n { value: \u0027oranges\u0027, label: \u0027Oranges\u0027 },\n ],\n // ...\n }),\n // ...\n },\n // ...\n});\n```\n\n#### Mitigation\nPlease upgrade to `@keystone-6/core \u003e= 2.3.1`, where this vulnerability has been closed.\n\n#### Workarounds\nIf for some reason you cannot upgrade your dependencies, you should stop using the `multiselect` field.\n\n#### Credits\nThanks to [Marek R](https://github.com/marekryb) for reporting and submitting the pull request to fix this problem.\n\nIf you have any questions around this security advisory, please don\u0027t hesitate to contact us at [security@keystonejs.com](mailto:security@keystonejs.com), or [open an issue on GitHub](https://github.com/keystonejs/keystone/issues/new/choose).\n\nIf you have a security flaw to report for any software in this repository, please see our [SECURITY policy](https://github.com/keystonejs/keystone/blob/main/SECURITY.md).",
"id": "GHSA-6mhr-52mv-6v6f",
"modified": "2022-10-18T17:12:46Z",
"published": "2022-10-18T17:12:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/keystonejs/keystone/security/advisories/GHSA-6mhr-52mv-6v6f"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-39322"
},
{
"type": "WEB",
"url": "https://github.com/keystonejs/keystone/commit/65c6ee3deef23605fc72b80230908696a7a65e7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/keystonejs/keystone"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Field-level access-control bypass for multiselect field"
}
GHSA-6MWH-463X-C3V4
Vulnerability from github – Published: 2022-02-25 00:01 – Updated: 2023-08-08 15:31An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.
{
"affected": [],
"aliases": [
"CVE-2022-25402"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-02-24T15:15:00Z",
"severity": "CRITICAL"
},
"details": "An incorrect access control issue in HMS v1.0 allows unauthenticated attackers to read and modify all PHP files.",
"id": "GHSA-6mwh-463x-c3v4",
"modified": "2023-08-08T15:31:44Z",
"published": "2022-02-25T00:01:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25402"
},
{
"type": "WEB",
"url": "https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6MXQ-JR92-3H2R
Vulnerability from github – Published: 2026-07-22 12:32 – Updated: 2026-08-05 21:49Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-qq9q-x9w4-chhj. This link is maintained to preserve external references.
Original Description
Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 3.7.7"
},
"package": {
"ecosystem": "Go",
"name": "github.com/traefik/traefik"
},
"ranges": [
{
"events": [
{
"introduced": "3.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-05T21:49:07Z",
"nvd_published_at": "2026-07-22T12:18:20Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-qq9q-x9w4-chhj. This link is maintained to preserve external references.\n\n## Original Description\nTraefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace instead of the HTTPRoute namespace. A low-privileged route author holding a ReferenceGrant for a cross-namespace Service could therefore bind a Traefik Middleware from the backend namespace without a separate grant for that middleware, potentially injecting trusted reverse-proxy identity headers into downstream requests. The issue is fixed in version 3.7.7.",
"id": "GHSA-6mxq-jr92-3h2r",
"modified": "2026-08-05T21:49:07Z",
"published": "2026-07-22T12:32:18Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/security/advisories/GHSA-qq9q-x9w4-chhj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65601"
},
{
"type": "WEB",
"url": "https://github.com/traefik/traefik/commit/26c96a3935cafb473f4a5bae1886560d9aa4e4f0"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/traefik-before-namespace-confusion-via-httproute-extensionref"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: Traefik Gateway API HTTPRoute BackendRef ExtensionRef Namespace Confusion",
"withdrawn": "2026-08-05T21:49:07Z"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.