CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6872 vulnerabilities reference this CWE, most recent first.
GHSA-8QFX-VRVV-QMQR
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-07-13 00:01The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021.
{
"affected": [],
"aliases": [
"CVE-2021-3006"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-03T06:15:00Z",
"severity": "HIGH"
},
"details": "The breed function in the smart contract implementation for Farm in Seal Finance (Seal), an Ethereum token, lacks access control and thus allows price manipulation, as exploited in the wild in December 2020 and January 2021.",
"id": "GHSA-8qfx-vrvv-qmqr",
"modified": "2022-07-13T00:01:18Z",
"published": "2022-05-24T17:37:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3006"
},
{
"type": "WEB",
"url": "https://blocksecteam.medium.com/security-incident-on-seal-finance-fa79c27a1c3b"
},
{
"type": "WEB",
"url": "https://etherscan.io/address/0x33c2da7fd5b125e629b3950f3c38d7f721d7b30d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8QG5-7FVG-HRC7
Vulnerability from github – Published: 2024-10-24 18:30 – Updated: 2024-10-24 21:31Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file.
{
"affected": [],
"aliases": [
"CVE-2024-48542"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-24T17:15:17Z",
"severity": "HIGH"
},
"details": "Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sensitive information by analyzing the code and data within the APK file.",
"id": "GHSA-8qg5-7fvg-hrc7",
"modified": "2024-10-24T21:31:03Z",
"published": "2024-10-24T18:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48542"
},
{
"type": "WEB",
"url": "https://github.com/HankJames/Vul-Reports/blob/main/FirmwareLeakage/com.yamaha.sc.hpcontroller/com.yamaha.sc.hpcontroller.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QG5-X5VM-75JX
Vulnerability from github – Published: 2026-07-29 18:31 – Updated: 2026-07-29 18:31A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.
{
"affected": [],
"aliases": [
"CVE-2026-18236"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-29T18:16:52Z",
"severity": "CRITICAL"
},
"details": "A vulnerability in the Agent Development Kit (ADK) allows for continuation forgery in tool confirmations. An attacker who is able to manipulate or inject events into the session history can execute unauthorized tools by forging a tool confirmation response. This is possible because the framework did not verify if the target tool was registered to the executing agent, did not validate if the tool actually required confirmation, and did not match the confirmation arguments against the original tool call event in the history.",
"id": "GHSA-8qg5-x5vm-75jx",
"modified": "2026-07-29T18:31:40Z",
"published": "2026-07-29T18:31:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18236"
},
{
"type": "WEB",
"url": "https://github.com/google/adk-python/commit/c03f333769feaeaa9fe8910fbe95cb9f2d513f54"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-8QGH-C754-3CRV
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2025-11-04 21:30Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey.
{
"affected": [],
"aliases": [
"CVE-2020-26560"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-24T18:15:00Z",
"severity": "HIGH"
},
"details": "Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey.",
"id": "GHSA-8qgh-c754-3crv",
"modified": "2025-11-04T21:30:25Z",
"published": "2022-05-24T19:03:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26560"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/799380"
},
{
"type": "WEB",
"url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/799380"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8QJV-HP27-6G2R
Vulnerability from github – Published: 2024-07-31 06:30 – Updated: 2024-08-01 15:32it's possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.
{
"affected": [],
"aliases": [
"CVE-2024-6695"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-31T06:15:04Z",
"severity": "CRITICAL"
},
"details": "it\u0027s possible for an attacker to gain administrative access without having any kind of account on the targeted site and perform unauthorized actions. This is due to improper logic flow on the user registration process.",
"id": "GHSA-8qjv-hp27-6g2r",
"modified": "2024-08-01T15:32:16Z",
"published": "2024-07-31T06:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6695"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/4afa5c85-ce27-4ca7-bba2-61fb39c53a5b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-8QJV-JJ2Q-X832
Vulnerability from github – Published: 2026-05-06 17:05 – Updated: 2026-06-08 23:41Description
Under specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.
Am I Affected?
Users are affected if they meet each of the following preconditions: - Applications built using Auth0.js version between 8.11.0 and 9.32.0 - The application’s access control relies on rules defined in Auth0 Actions.
Affected product and versions
auth0.js SDK v8.11.0 to v9.32.0
Resolution
Upgrade auth0/auth0.js to v10.0.0 or greater.
Acknowledgements
Okta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 9.32.0"
},
"package": {
"ecosystem": "npm",
"name": "auth0-js"
},
"ranges": [
{
"events": [
{
"introduced": "8.11.0"
},
{
"fixed": "10.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42280"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-06T17:05:14Z",
"nvd_published_at": "2026-05-27T15:16:27Z",
"severity": "HIGH"
},
"details": "### Description\nUnder specific preconditions, the Auth0.js SDK may improperly return user profile information using a valid access token when a specifically crafted invalid ID token is provided.\n\n### Am I Affected?\nUsers are affected if they meet each of the following preconditions:\n- Applications built using Auth0.js version between 8.11.0 and 9.32.0\n- The application\u2019s access control relies on rules defined in Auth0 Actions.\n\n\n### Affected product and versions\nauth0.js SDK v8.11.0 to v9.32.0\n\n### Resolution\nUpgrade auth0/auth0.js to v10.0.0 or greater.\n\n### Acknowledgements\nOkta would like to thank Quan Le (@aleister1102) for their discovery and responsible disclosure.",
"id": "GHSA-8qjv-jj2q-x832",
"modified": "2026-06-08T23:41:42Z",
"published": "2026-05-06T17:05:14Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/auth0/auth0.js/security/advisories/GHSA-8qjv-jj2q-x832"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42280"
},
{
"type": "PACKAGE",
"url": "https://github.com/auth0/auth0.js"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Auth.js SDK has Improper Permission Checking"
}
GHSA-8QM4-6R58-2HRP
Vulnerability from github – Published: 2026-09-14 21:31 – Updated: 2026-09-16 15:30An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to access the System Keychain.
{
"affected": [],
"aliases": [
"CVE-2026-84628"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-14T21:17:37Z",
"severity": "MODERATE"
},
"details": "An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to access the System Keychain.",
"id": "GHSA-8qm4-6r58-2hrp",
"modified": "2026-09-16T15:30:48Z",
"published": "2026-09-14T21:31:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84628"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149034"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149035"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149036"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149037"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/149038"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8QV9-VPW9-7Q8X
Vulnerability from github – Published: 2024-04-17 00:30 – Updated: 2024-04-17 00:30Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8.5.6 and 8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).
{
"affected": [],
"aliases": [
"CVE-2024-21120"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-16T22:15:34Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). Supported versions that are affected are 8.5.6 and 8.5.7. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Outside In Technology accessible data as well as unauthorized read access to a subset of Oracle Outside In Technology accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Outside In Technology. CVSS 3.1 Base Score 5.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).",
"id": "GHSA-8qv9-vpw9-7q8x",
"modified": "2024-04-17T00:30:57Z",
"published": "2024-04-17T00:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21120"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2024.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-8R5Q-34MQ-7WV5
Vulnerability from github – Published: 2025-07-15 21:31 – Updated: 2025-07-15 21:31Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.11-12.2.13. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. While the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data as well as unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N).
{
"affected": [],
"aliases": [
"CVE-2025-30739"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-15T20:15:28Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.11-12.2.13. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. While the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data as well as unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N).",
"id": "GHSA-8r5q-34mq-7wv5",
"modified": "2025-07-15T21:31:39Z",
"published": "2025-07-15T21:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30739"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-8R8H-6VCC-XHRV
Vulnerability from github – Published: 2026-08-04 17:43 – Updated: 2026-08-04 17:43Finding — Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view)
### What’s wrong (code locations)
- Variables for the active workspace are fetched without checking “variables:view” at this call site: flowise-src/ packages/components/src/utils.ts:932
- Runtime variables are resolved from server environment variables: flowise-src/packages/components/src/utils.ts:976
- $vars is always injected into the code execution sandbox: flowise-src/packages/components/src/utils.ts:1782
- The official Variables API is permission-protected (contrast): flowise-src/packages/server/src/routes/variables/ index.ts:11
### Why it is a privilege boundary bypass
A user/API key might be denied variables:view (and the /api/v1/variables route enforces it), but they can still:
- call /api/v1/node-custom-function (Finding 1)
- and have $vars pre-populated with all variables for the workspace, including runtime values from process.env
### What data is exposed
Inside the custom JS context, $vars contains a flat map of:
- Variable.name -> Variable.value for static variables, and
- Variable.name -> process.env[Variable.name] for runtime variables (type === 'runtime')
This can expose secrets such as database passwords, JWT secrets, SMTP passwords, cloud keys, etc., depending on what the workspace Variables are configured to map.
### Recommended fix (minimum)
- Do not inject $vars unless the caller is authorized:
- enforce variables:view before injecting $vars, or
- inject only an explicit allowlist of variables needed for the function
- Consider disabling or heavily restricting type=runtime variables in self-hosted environments (or restrict which env keys may be mapped).
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.1.2"
},
"package": {
"ecosystem": "npm",
"name": "flowise"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-70471"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-04T17:43:36Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Finding \u2014 Unauthorized Workspace Variables disclosure via $vars injection (bypasses variables:view)\n\n ### What\u2019s wrong (code locations)\n\n - Variables for the active workspace are fetched without checking \u201cvariables:view\u201d at this call site: flowise-src/\n packages/components/src/utils.ts:932\n - Runtime variables are resolved from server environment variables: flowise-src/packages/components/src/utils.ts:976\n - $vars is always injected into the code execution sandbox: flowise-src/packages/components/src/utils.ts:1782\n - The official Variables API is permission-protected (contrast): flowise-src/packages/server/src/routes/variables/\n index.ts:11\n\n ### Why it is a privilege boundary bypass\n\n A user/API key might be denied variables:view (and the /api/v1/variables route enforces it), but they can still:\n\n - call /api/v1/node-custom-function (Finding 1)\n - and have $vars pre-populated with all variables for the workspace, including runtime values from process.env\n\n ### What data is exposed\n\n Inside the custom JS context, $vars contains a flat map of:\n\n - Variable.name -\u003e Variable.value for static variables, and\n - Variable.name -\u003e process.env[Variable.name] for runtime variables (type === \u0027runtime\u0027)\n\n This can expose secrets such as database passwords, JWT secrets, SMTP passwords, cloud keys, etc., depending on what\n the workspace Variables are configured to map.\n\n ### Recommended fix (minimum)\n\n - Do not inject $vars unless the caller is authorized:\n - enforce variables:view before injecting $vars, or\n - inject only an explicit allowlist of variables needed for the function\n - Consider disabling or heavily restricting type=runtime variables in self-hosted environments (or restrict which env\n keys may be mapped).",
"id": "GHSA-8r8h-6vcc-xhrv",
"modified": "2026-08-04T17:43:36Z",
"published": "2026-08-04T17:43:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-8r8h-6vcc-xhrv"
},
{
"type": "PACKAGE",
"url": "https://github.com/FlowiseAI/Flowise"
},
{
"type": "WEB",
"url": "https://github.com/FlowiseAI/Flowise/releases/tag/flowise@3.1.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.