CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6878 vulnerabilities reference this CWE, most recent first.
GHSA-938V-9F84-R9R2
Vulnerability from github – Published: 2022-05-24 17:47 – Updated: 2022-05-24 17:47vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.
{
"affected": [],
"aliases": [
"CVE-2021-28793"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-20T13:15:00Z",
"severity": "CRITICAL"
},
"details": "vscode-restructuredtext before 146.0.0 contains an incorrect access control vulnerability, where a crafted project folder could execute arbitrary binaries via crafted workspace configuration.",
"id": "GHSA-938v-9f84-r9r2",
"modified": "2022-05-24T17:47:56Z",
"published": "2022-05-24T17:47:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28793"
},
{
"type": "WEB",
"url": "https://github.com/vscode-restructuredtext/vscode-restructuredtext/commit/1dd3e878a5559e3dfe0e48f145c90418b208c5af"
},
{
"type": "WEB",
"url": "https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases"
},
{
"type": "WEB",
"url": "https://github.com/vscode-restructuredtext/vscode-restructuredtext/releases/tag/147.0.0"
},
{
"type": "WEB",
"url": "https://vuln.ryotak.me/advisories/37"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-93CJ-9G5C-FR4X
Vulnerability from github – Published: 2026-03-26 12:30 – Updated: 2026-03-26 12:30Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter 'ID' in '/api/v1/download//'.
{
"affected": [],
"aliases": [
"CVE-2026-4262"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-26T10:16:25Z",
"severity": "MODERATE"
},
"details": "Vulnerability of incorrect authorization in\u00a0HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter \u0027ID\u0027 in \u0027/api/v1/download/\u003cID\u003e/\u0027.",
"id": "GHSA-93cj-9g5c-fr4x",
"modified": "2026-03-26T12:30:29Z",
"published": "2026-03-26T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4262"
},
{
"type": "WEB",
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-hijiffy-chatbot"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-93FV-965W-2985
Vulnerability from github – Published: 2023-03-21 18:30 – Updated: 2023-03-24 21:30An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API requests.
{
"affected": [],
"aliases": [
"CVE-2022-45636"
],
"database_specific": {
"cwe_ids": [
"CWE-862",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-03-21T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS \u0026 Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API requests.",
"id": "GHSA-93fv-965w-2985",
"modified": "2023-03-24T21:30:54Z",
"published": "2023-03-21T18:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45636"
},
{
"type": "WEB",
"url": "https://github.com/WithSecureLabs/megafeis-palm/tree/main/CVE-2022-45636"
},
{
"type": "WEB",
"url": "https://labs.withsecure.com/advisories/insecure-authorization-scheme-for-api-requests-in-dbd--mobile-co"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-93P6-9CXV-5RPQ
Vulnerability from github – Published: 2024-01-09 03:30 – Updated: 2025-04-17 22:54juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "juzaweb/cms"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-46906"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2024-01-09T17:22:40Z",
"nvd_published_at": "2024-01-09T01:15:38Z",
"severity": "MODERATE"
},
"details": "juzaweb \u003c= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. The payload in the timezone field was not correctly validated.",
"id": "GHSA-93p6-9cxv-5rpq",
"modified": "2025-04-17T22:54:55Z",
"published": "2024-01-09T03:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46906"
},
{
"type": "PACKAGE",
"url": "https://github.com/juzaweb/cms"
},
{
"type": "WEB",
"url": "https://www.sumor.top/index.php/archives/880"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "juzawebCMS Incorrect Access Control vulnerability"
}
GHSA-93PJ-4P65-QMR9
Vulnerability from github – Published: 2022-01-28 22:07 – Updated: 2022-02-02 16:13A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.11"
},
{
"fixed": "3.11.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.10"
},
{
"fixed": "3.10.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.9.11"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-0334"
],
"database_specific": {
"cwe_ids": [
"CWE-668",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-01-26T22:48:21Z",
"nvd_published_at": "2022-01-25T20:15:00Z",
"severity": "MODERATE"
},
"details": "A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.",
"id": "GHSA-93pj-4p65-qmr9",
"modified": "2022-02-02T16:13:31Z",
"published": "2022-01-28T22:07:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0334"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/1964d68f8500ea3c7b776fa8a2af6266ed109f84"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/6d18f136ae88ec97e351a723df570816a959ec68"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2043664"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=431102"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Insufficient user authorization in Moodle"
}
GHSA-93R2-J783-G4WF
Vulnerability from github – Published: 2024-09-17 00:31 – Updated: 2025-11-04 18:31The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to modify protected parts of the file system.
{
"affected": [],
"aliases": [
"CVE-2024-40843"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-17T00:15:49Z",
"severity": "MODERATE"
},
"details": "The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. An app may be able to modify protected parts of the file system.",
"id": "GHSA-93r2-j783-g4wf",
"modified": "2025-11-04T18:31:19Z",
"published": "2024-09-17T00:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-40843"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/121238"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2024/Sep/33"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-93WH-35R4-6QMW
Vulnerability from github – Published: 2021-03-29 20:43 – Updated: 2022-08-11 16:37It was possible for some users without permission to view other users' full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.10.0"
},
{
"fixed": "3.10.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.9.0"
},
{
"fixed": "3.9.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.8.0"
},
{
"fixed": "3.8.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "moodle/moodle"
},
"ranges": [
{
"events": [
{
"introduced": "3.5"
},
{
"fixed": "3.5.17"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-20281"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-03-24T23:14:27Z",
"nvd_published_at": "2021-03-15T22:15:00Z",
"severity": "MODERATE"
},
"details": "It was possible for some users without permission to view other users\u0027 full names to do so via the online users block in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17.",
"id": "GHSA-93wh-35r4-6qmw",
"modified": "2022-08-11T16:37:15Z",
"published": "2021-03-29T20:43:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20281"
},
{
"type": "WEB",
"url": "https://github.com/moodle/moodle/commit/33d6017287e1835513a3de8edd3fbf7a6a90af9c"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1939041"
},
{
"type": "PACKAGE",
"url": "https://github.com/moodle/moodle"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AFSNJ7XHVTC52RSRX2GBQFF3VEEAY2MS"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UFH5DDMU5TZ3JT4Q52WMRAHACA5MHIMT"
},
{
"type": "WEB",
"url": "https://moodle.org/mod/forum/discuss.php?d=419652"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Moodle allowed some users without permission to view other users\u0027 full names"
}
GHSA-93XX-CVMC-9W3V
Vulnerability from github – Published: 2023-05-09 19:58 – Updated: 2023-05-09 19:58Impact
If a malicious user gains control of a Kubernetes node running fluid csi pod (controlled by the csi-nodeplugin-fluid node-daemonset), he/she can leverage the fluid-csi service account to modify specs of all the nodes in the cluster. However, since this service account lacks "list node" permissions, the attacker may need to use other techniques to identify vulnerable nodes.
Once the attacker identifies and modifies the node specs, he/she can manipulate system-level-privileged components to access all secrets in the cluster or execute pods on other nodes. This allows he/she to elevate privileges beyond the compromised node and potentially gain full privileged access to the whole cluster.
To exploit this vulnerability, the attacker can make all other nodes unschedulable (for example, patch node with taints) and wait for system-critical components with high privilege to appear on the compromised node. However, this attack requires two prerequisites: a compromised node and identifying all vulnerable nodes through other means. Additionally, since the attack is passive and requires patience and luck, the severity of this finding is considered medium.
Patches
For users who're using version < 0.8.6, >= 0.7.0, upgrade to v0.8.6.
Workarounds
Delete the csi-nodeplugin-fluid daemonset in fluid-system namespace and avoid using CSI mode to mount FUSE file systems. Alternatively using sidecar mode to mount FUSE file systems is recommended. Refer to the doc to get a full example of how to use sidecar mode.
References
Fixed by Fix rbacs and limit CSI Plugin's node related access
Credits
Special thanks to the discoverers of this issue:
Nanzi Yang (nzyang@stu.xidian.edu.cn)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/fluid-cloudnative/fluid"
},
"ranges": [
{
"events": [
{
"introduced": "0.7.0"
},
{
"fixed": "0.8.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-30840"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-05-09T19:58:47Z",
"nvd_published_at": "2023-05-08T18:15:14Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nIf a malicious user gains control of a Kubernetes node running fluid csi pod (controlled by the `csi-nodeplugin-fluid` node-daemonset), he/she can leverage the fluid-csi service account to modify specs of all the nodes in the cluster. However, since this service account lacks \"list node\" permissions, the attacker may need to use other techniques to identify vulnerable nodes.\n\nOnce the attacker identifies and modifies the node specs, he/she can manipulate system-level-privileged components to access all secrets in the cluster or execute pods on other nodes. This allows he/she to elevate privileges beyond the compromised node and potentially gain full privileged access to the whole cluster.\n\nTo exploit this vulnerability, the attacker can make all other nodes unschedulable (for example, patch node with taints) and wait for system-critical components with high privilege to appear on the compromised node. However, this attack requires two prerequisites: a compromised node and identifying all vulnerable nodes through other means. Additionally, since the attack is passive and requires patience and luck, the severity of this finding is considered medium.\n\n### Patches\nFor users who\u0027re using version \u003c 0.8.6, \u003e= 0.7.0, upgrade to v0.8.6.\n\n### Workarounds\nDelete the `csi-nodeplugin-fluid` daemonset in `fluid-system` namespace and avoid using CSI mode to mount FUSE file systems. Alternatively using sidecar mode to mount FUSE file systems is recommended. Refer to [the doc](https://github.com/fluid-cloudnative/fluid/blob/master/docs/en/samples/knative.md) to get a full example of how to use sidecar mode.\n\n### References\n\n\nFixed by [Fix rbacs and limit CSI Plugin\u0027s node related access](https://github.com/fluid-cloudnative/fluid/commit/77c8110a3d1ec077ae2bce6bd88d296505db1550)\n\n### Credits\nSpecial thanks to the discoverers of this issue:\n\nNanzi Yang ([nzyang@stu.xidian.edu.cn](mailto:nzyang@stu.xidian.edu.cn))\n",
"id": "GHSA-93xx-cvmc-9w3v",
"modified": "2023-05-09T19:58:47Z",
"published": "2023-05-09T19:58:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/fluid-cloudnative/fluid/security/advisories/GHSA-93xx-cvmc-9w3v"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30840"
},
{
"type": "WEB",
"url": "https://github.com/fluid-cloudnative/fluid/commit/77c8110a3d1ec077ae2bce6bd88d296505db1550"
},
{
"type": "WEB",
"url": "https://github.com/fluid-cloudnative/fluid/commit/91c05c32db131997b5ca065e869c9918a125c149"
},
{
"type": "PACKAGE",
"url": "https://github.com/fluid-cloudnative/fluid"
},
{
"type": "WEB",
"url": "https://github.com/fluid-cloudnative/fluid/releases/tag/v0.8.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "On a compromised node, the fluid-csi service account can be used to modify node specs"
}
GHSA-944W-6C47-G6XP
Vulnerability from github – Published: 2022-05-24 17:38 – Updated: 2022-05-24 17:38The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.
{
"affected": [],
"aliases": [
"CVE-2020-36175"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-06T15:15:00Z",
"severity": "MODERATE"
},
"details": "The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field.",
"id": "GHSA-944w-6c47-g6xp",
"modified": "2022-05-24T17:38:06Z",
"published": "2022-05-24T17:38:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36175"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/ninja-forms/#developers"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-945P-45HQ-35X9
Vulnerability from github – Published: 2025-01-21 21:30 – Updated: 2025-11-03 21:32Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
{
"affected": [],
"aliases": [
"CVE-2025-21519"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T21:15:17Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.40 and prior, 8.4.3 and prior and 9.1.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).",
"id": "GHSA-945p-45hq-35x9",
"modified": "2025-11-03T21:32:18Z",
"published": "2025-01-21T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21519"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20250131-0004"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.