Cyber Posture

CWE · MITRE source

CWE-284Improper Access Control

Abstraction: Pillar · CVEs in our corpus: 4,814

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Access control involves the use of several protection mechanisms such as: When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses:

Last updated: 09 May 2026 03:25 UTC

NIST 800-53 r5 controls that address this weakness (168)AI

Showing the 15 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
SC-1Policy and ProceduresSCEstablishes organizational policy defining roles, responsibilities, and compliance for system and communications protection, tangibly strengthening access control enforcement.
SC-14Public Access ProtectionsSCDirectly requires mechanisms to restrict public users from unauthorized actions on system resources.
SC-15Collaborative Computing Devices and ApplicationsSCDirectly enforces access control by prohibiting unauthorized remote activation of cameras, mics, and similar devices.
PM-1Information Security Program PlanPMMandating protection of the plan from unauthorized access and modification enforces access control on this organization-wide security governance artifact.
PM-10Authorization ProcessPMFormal authorization processes require review and approval of access control mechanisms before systems are permitted to operate, directly reducing the likelihood of improper access control weaknesses reaching production.
PM-11Mission and Business Process DefinitionPMRequires explicit consideration of information security risks when defining processes, which tangibly drives proper access control requirements into those processes.
AC-1Policy and ProceduresACThe access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
AC-11Device LockACDevice lock enforces restricted access until re-authentication, directly reducing unauthorized use of active sessions.
AC-13Supervision and Review — Access ControlACSupervision and review of access control activities directly detects and remediates improper access configurations or usages.
SA-11Developer Testing and EvaluationSAExplicit security control assessments verify proper access control enforcement, detecting weaknesses that the flaw remediation process then eliminates.
SA-14Criticality AnalysisSAThe analysis highlights critical resources that require strong access-control enforcement, thereby reducing the chance that improper access control will be present on those resources.
SA-16Developer-provided TrainingSAExplicit training on access control mechanisms and their operation makes improper access control harder to introduce via misconfiguration.
CM-1Policy and ProceduresCMDefines roles, responsibilities, and access rules for configuration management activities, making improper access to configuration resources harder to exploit.
CM-11User-installed SoftwareCMThis control establishes and enforces policies that restrict which users can install software and what software is permitted.
CM-12Information LocationCMIdentifying users with access to specific system components supports enforcement of proper access controls on information.
Show 153 more broadly-applicable controls
SC-16Transmission of Security and Privacy AttributesSCTransmitting bound security attributes preserves access-control context across system boundaries, directly reducing improper access control.
SC-19Voice Over Internet ProtocolSCAuthorizing and controlling VoIP use directly enforces access control decisions over a distinct communication technology.
SC-2Separation of System and User FunctionalitySCExplicit separation implements access control boundaries between user interfaces and system management functionality.
SC-22Architecture and Provisioning for Name/Address Resolution ServiceSCRole separation implements access control boundaries between internal and external name resolution services.
SC-26DecoysSCDecoy resources detect and deflect attempts to bypass access controls by attracting and monitoring attackers on fake assets.
SC-27Platform-independent ApplicationsSCSandboxing and security contexts provided by platform-independent runtimes add an enforceable access-control boundary that is independent of the host OS.
SC-3Security Function IsolationSCBy design the control implements a hard boundary that prevents unauthorized actors or non-security functions from reaching security-critical resources or entry points.
SC-32System PartitioningSCEnforces separation of domains that reduces the ability to bypass or violate access control boundaries.
SC-34Non-modifiable Executable ProgramsSCHardware-enforced read-only media directly implements strong access control preventing any modification of executables.
SC-36Distributed Processing and StorageSCDistribution forces an attacker to compromise multiple independent components rather than a single centralized target, directly reducing the impact of access control failures.
SC-39Process IsolationSCMaintaining distinct execution domains directly implements access-control separation between processes, blocking unauthorized cross-process access.
SC-41Port and I/O Device AccessSCDisabling or removing ports and I/O devices directly enforces hardware-level access control by eliminating entry points.
SC-42Sensor Capability and DataSCProhibiting specific sensor capabilities implements an access-control policy on hardware resources that would otherwise be freely usable by unauthorized software.
SC-43Usage RestrictionsSCRequiring authorization, monitoring, and control of component use directly enforces access control decisions on system resources.
SC-46Cross Domain Policy EnforcementSCCross-domain policy enforcement implements mandatory access control at domain boundaries, directly preventing unauthorized interactions across security domains.
SC-48Sensor RelocationSCDynamic relocation of sensors directly strengthens access control enforcement by removing predictable monitoring gaps that attackers could otherwise map and evade.
SC-49Hardware-enforced Separation and Policy EnforcementSCHardware-enforced separation directly implements strong access control boundaries that software alone cannot bypass.
SC-50Software-enforced Separation and Policy EnforcementSCDirectly implements software-enforced boundaries that prevent unauthorized access across separated components or domains.
SC-51Hardware-based ProtectionSCHardware write-protect enforces access control on critical resources (e.g., firmware) independent of software state.
SC-7Boundary ProtectionSCBoundary devices and interface controls directly enforce network-level access restrictions between spheres.
PM-12Insider Threat ProgramPMProgram provides ongoing monitoring and handling of access-control violations that insiders could otherwise exploit undetected.
PM-13Security and Privacy WorkforcePMSecurity training teaches correct access-control models and enforcement, lowering the incidence of improper access control.
PM-14Testing, Training, and MonitoringPMOngoing testing, training, and monitoring plans verify that access-control enforcement remains effective and aligned with risk priorities.
PM-18Privacy Program PlanPMThe mandated organization-wide privacy program plan requires identification and assignment of privacy controls (including access restrictions on PII) plus explicit role accountability, directly reducing the likelihood of missing or inconsistently applied access-control mechanisms.
PM-19Privacy Program Leadership RolePMSenior privacy official has authority to implement and enforce access controls protecting personal information across the organization.
PM-2Information Security Program Leadership RolePMThe appointed officer coordinates development and maintenance of access control policies and oversight across the enterprise.
PM-21Accounting of DisclosuresPMAccurate accounting of disclosures presupposes and thereby incentivizes proper access-control enforcement; gaps become visible when individuals review their records.
PM-23Data Governance BodyPMData governance body defines and oversees organizational access control policies for data resources, reducing improper access control.
PM-24Data Integrity BoardPMBoard oversight enforces proper access-control decisions before cross-agency data matching occurs, reducing improper access to protected records.
PM-26Complaint ManagementPMEnables users to surface and force remediation of improper access-control decisions in security practices, directly reducing the persistence of exploitable authorization gaps.
PM-27Privacy ReportingPMAccountability reporting on privacy mandates surfaces improper access control violations over personal data during compliance reviews.
PM-29Risk Management Program Leadership RolesPMAppointed accountable official aligns access control decisions with strategic risk processes, reducing systemic improper access control.
PM-3Information Security and Privacy ResourcesPMResources allocated to security programs enable proper design, implementation, and maintenance of access control mechanisms.
PM-32PurposingPMPeriodic purpose analysis directly detects and corrects access control decisions that permit use outside the defined mission function.
PM-4Plan of Action and Milestones ProcessPMPOA&M process requires documented remedial actions and tracking for identified access control deficiencies until resolved per risk priorities.
PM-5System InventoryPMComplete system listing is a prerequisite for applying and verifying access controls across the entire organizational boundary.
PM-7Enterprise ArchitecturePMEnterprise architecture defines overarching access control models, boundaries, and trust zones that directly prevent improper access control weaknesses.
PM-8Critical Infrastructure PlanPMA CIKR protection plan that explicitly addresses information security requires defining and enforcing access control policies on critical systems and resources.
PM-9Risk Management StrategyPMRisk management strategy defines organization-wide access control policies and risk acceptance, directly reducing improper access control weaknesses.
AC-14Permitted Actions Without Identification or AuthenticationACExplicitly identifying and documenting actions permitted without identification or authentication enforces proper access control boundaries by defining justified exceptions.
AC-15Automated MarkingACBy automatically labeling outputs with security attributes, the control supports attribute-based enforcement and reduces exploitability of improper access control weaknesses.
AC-16Security and Privacy AttributesACAssociating and retaining security attributes with data directly supports enforcement of access control decisions across storage, processing, and transmission.
AC-17Remote AccessACRequiring prior authorization for each remote access type prevents improper access control over remote connections.
AC-18Wireless AccessACRequiring authorization of wireless access before allowing connections enforces proper access control for this access method.
AC-19Access Control for Mobile DevicesACRequiring authorization and configuration controls for mobile device connections directly enforces access control and prevents unauthorized devices from reaching organizational systems.
AC-2Account ManagementACDefining account types, requiring approvals for creation, specifying authorizations, monitoring usage, and reviewing accounts directly prevents improper access control by ensuring only authorized accounts exist and are used.
AC-20Use of External SystemsACEnforces rules governing access to the system and its data from external systems based on established trust relationships.
AC-21Information SharingACThis control requires verifying that a sharing partner's access authorizations match the information's restrictions before sharing occurs.
AC-22Publicly Accessible ContentACDesignating authorized individuals and mandating pre/post-publication reviews enforces access controls on who can publish content publicly.
AC-23Data Mining ProtectionACProvides monitoring and protection against data mining patterns that exploit improper access controls to extract data.
AC-24Access Control DecisionsACEnsuring access control decisions are made and applied to every request before enforcement directly prevents improper access control by requiring policy-based checks.
AC-25Reference MonitorACProvides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies.
AC-3Access EnforcementACEnforcing approved authorizations directly implements access control policies to block unauthorized access.
AC-4Information Flow EnforcementACEnforcing approved authorizations for information flows directly implements access control over data movements within and between systems.
AC-5Separation of DutiesACDefining authorizations to support separation of duties strengthens overall access control by preventing unauthorized combinations of actions within a single account.
AC-6Least PrivilegeACSupports proper access control through restriction to only authorized necessary accesses.
AC-8System Use NotificationACRequiring explicit acknowledgment of the notification before granting access enforces a mandatory step in the access process, reducing the ability to exploit improper access control weaknesses.
SA-17Developer Security and Privacy Architecture and DesignSARequires explicit allocation of controls to physical and logical components, directly preventing architectural gaps in access enforcement.
SA-18Tamper Resistance and DetectionSATamper resistance mechanisms directly enforce access control boundaries to prevent unauthorized modification of hardware, firmware, or software.
SA-23SpecializationSAPurpose-built components enable tighter, function-specific access-control enforcement that is harder to bypass than controls on general-purpose platforms.
SA-24Design For Cyber ResiliencySAResiliency goals and objectives routinely incorporate least-privilege and access-control maintenance under adverse conditions, reducing improper access control.
SA-3System Development Life CycleSADefining security roles/responsibilities and integrating risk management into the SDLC directly reduces improper access control by ensuring access decisions are designed and reviewed throughout development.
SA-5System DocumentationSAGuidance on effective use of access control mechanisms and known configuration vulnerabilities makes improper access control harder to exploit.
SA-7User-installed SoftwareSAImplements authorization checks and policies that prevent unauthorized software installation.
SA-8Security and Privacy Engineering PrinciplesSAComplete-mediation and least-privilege principles ensure proper access-control design and enforcement.
SA-9External System ServicesSARequiring external providers to implement and be monitored against organizational access-control requirements directly reduces the likelihood of improper access control across trust boundaries.
CM-13Data Action MappingCMMapping data actions reveals potential improper access controls by showing who can perform actions on data.
CM-2Baseline ConfigurationCMBaseline includes documented access control settings that are reviewed and maintained, reducing the ability to exploit improper access control.
CM-3Configuration Change ControlCMEnforces access controls and oversight on who can propose, approve, or implement configuration modifications.
CM-4Impact AnalysesCMPrior analysis ensures modifications do not create or worsen improper access control enforcement.
CM-5Access Restrictions for ChangeCMEnforcing physical and logical access restrictions for system changes directly prevents unauthorized actors from modifying the system.
CM-6Configuration SettingsCMRestrictive configuration settings implement and enforce proper access controls on system components.
CM-7Least FunctionalityCMRestricting available functions and services reduces the attack surface and enforces proper access control boundaries.
CM-9Configuration Management PlanCMExplicitly requires protecting the configuration management plan from unauthorized disclosure and modification.
PS-1Policy and ProceduresPSThe policy establishes consistent rules for granting, reviewing, and revoking access based on personnel status, tangibly limiting improper access control.
PS-2Position Risk DesignationPSScreening criteria tied to position sensitivity limit the set of individuals who can be granted access, shrinking the attack surface for improper access control weaknesses.
PS-3Personnel ScreeningPSPersonnel screening before access authorization directly strengthens access control decisions and reduces the chance that unvetted individuals can exploit improper access control weaknesses.
PS-4Personnel TerminationPSDisabling all system access and revoking credentials upon termination directly prevents improper access control by former personnel.
PS-5Personnel TransferPSEnsures access authorizations are updated on transfer so that access control remains aligned with current need rather than retained inappropriately.
PS-6Access AgreementsPSRequiring signed access agreements before any access is granted adds a mandatory procedural gate that directly prevents improper or premature access provisioning.
PS-7External Personnel SecurityPSEstablishes and monitors access-control requirements specifically for external personnel holding organizational credentials or privileges.
PS-8Personnel SanctionsPSReduces insider exploitation of access-control weaknesses through enforceable consequences for policy non-compliance.
PS-9Position DescriptionsPSClear role definitions in position descriptions are a prerequisite for implementing and enforcing proper access control decisions.
CA-1Policy and ProceduresCAThe policy defines roles, responsibilities, and management commitment for authorization and monitoring, establishing formal access controls over these security functions.
CA-2Control AssessmentsCAControl assessments verify that access controls are implemented correctly and operating as intended, detecting improper access control before exploitation.
CA-3Information ExchangeCARequiring formal approval, documented controls, and responsibilities for inter-system exchanges directly enforces proper access control between systems.
CA-4Security CertificationCACertification requires independent assessment confirming access controls are implemented correctly and effective.
CA-5Plan of Action and MilestonesCAWeaknesses in access control are explicitly planned for remediation based on assessments, directly reducing unauthorized access risks.
CA-6AuthorizationCARequires formal authorization of the system and inherited controls before operation, ensuring access control mechanisms are reviewed and approved.
CA-8Penetration TestingCAPenetration testing simulates unauthorized access attempts, directly detecting and enabling remediation of improper access control weaknesses.
CA-9Internal System ConnectionsCAAuthorizing and reviewing internal connections enforces proper access control over system interfaces.
PE-1Policy and ProceduresPEThe policy defines and enforces restrictions on physical access to resources, directly reducing improper access control.
PE-10Emergency ShutoffPEThe control directly implements access restrictions on the emergency shutoff mechanism to prevent unauthorized use.
PE-16Delivery and RemovalPEEnforces physical access controls on deliveries and removals to prevent unauthorized access to the facility and system components.
PE-17Alternate Work SitePEMandating and assessing controls at alternate sites enforces proper access control mechanisms that would otherwise be absent or weak in uncontrolled remote locations.
PE-23Facility LocationPEFacility siting decisions that account for physical hazards strengthen overall access control by limiting unauthorized physical entry vectors.
PE-4Access Control for TransmissionPEEnforces physical-layer access control on transmission resources, reducing the ability to reach or manipulate them outside intended boundaries.
PE-7Visitor ControlPEVisitor control enforces physical entry restrictions and monitoring, directly reducing improper access to facilities and resources.
PE-9Power Equipment and CablingPEReduces the attack surface for physical tampering or destruction of a critical system resource by enforcing environmental and access protections around power infrastructure.
RA-1Policy and ProceduresRARisk assessment policy requires systematic evaluation of access control decisions, reducing the likelihood that improper access control remains unaddressed.
RA-10Threat HuntingRAThreat hunting directly searches for indicators of unauthorized access or control violations that bypassed preventive mechanisms.
RA-2Security CategorizationRASecurity categorization determines the impact level that drives selection of appropriate access-control baselines.
RA-3Risk AssessmentRARisk assessment explicitly identifies threats from unauthorized access and drives decisions to implement or strengthen access control mechanisms.
RA-5Vulnerability Monitoring and ScanningRAScans identify improper access control implementations and missing protections on system resources.
RA-7Risk ResponseRAFindings of improper access control are routine outputs of audits and assessments; mandated response ensures the weaknesses are corrected before they can be exploited at scale.
RA-8Privacy Impact AssessmentsRAPIAs require evaluation of access control needs for PII, resulting in stronger restrictions that make unauthorized access harder to exploit.
RA-9Criticality AnalysisRACriticality analysis identifies components/functions requiring strict access control enforcement, directly reducing improper access control exposure.
PL-1Policy and ProceduresPLPolicy that assigns roles, responsibilities, and compliance requirements provides the foundation for consistent access-control decisions across the organization.
PL-11Baseline TailoringPLTailoring selects and adjusts the precise set of access-control baselines and compensating controls required for the system, directly reducing improper access control exposure.
PL-2System Security and Privacy PlansPLMandates defining roles/responsibilities, security categorization, and controls (including authorization) while protecting plans from unauthorized modification.
PL-4Rules of BehaviorPLDocumented and acknowledged rules define permitted access, reducing improper access control by establishing clear behavioral boundaries and accountability.
PL-7Concept of OperationsPLCONOPS describes the organization's intended security and privacy operating model, including access-control concepts, making systemic improper access control less likely to persist undetected.
PL-8Security and Privacy ArchitecturesPLArchitectures explicitly define requirements and mechanisms for access control to protect confidentiality, integrity, and availability.
PL-9Central ManagementPLCentral management enforces consistent access-control policies across systems, reducing the likelihood of missing or inconsistent enforcement.
PT-1Policy and ProceduresPTThe policy defines roles, responsibilities, and compliance requirements that establish and govern access controls for PII.
PT-2Authority to Process Personally Identifiable InformationPTRequires documented authority and explicit restriction of PII processing to only authorized actions, directly mitigating improper access control.
PT-3Personally Identifiable Information Processing PurposesPTImplements purpose-based restrictions that serve as an access control mechanism on PII handling and disclosure.
PT-4ConsentPTConsent enforcement adds an explicit access-control gate before any PII processing can occur.
PT-5Privacy NoticePTRequiring explicit identification of the authorizing authority and processing purposes in a publicly available notice increases accountability and makes covert improper access control decisions harder to sustain.
PT-8Computer Matching RequirementsPTRequires Data Integrity Board approval and formal matching agreements before any cross-system data processing occurs, directly enforcing access control on sensitive matching activities.
CP-10System Recovery and ReconstitutionCPRecovery to a known state reverts unauthorized changes to access control mechanisms after compromise.
CP-13Alternative Security MechanismsCPAlternative mechanisms sustain access control enforcement even if the primary access control implementation is unavailable or compromised.
CP-2Contingency PlanCPRequires protecting the contingency plan from unauthorized disclosure and modification, directly necessitating implementation of access controls on this critical document.
CP-6Alternate Storage SiteCPMandating equivalent access controls ensures the alternate site does not introduce improper access control weaknesses for backups.
CP-9System BackupCPProtecting CIA of backups requires access controls to prevent unauthorized access, modification, or deletion.
MA-2Controlled MaintenanceMAApproving and monitoring all maintenance activities prevents improper access control by restricting unauthorized personnel from performing maintenance on system components.
MA-3Maintenance ToolsMAApproving, controlling, and monitoring maintenance tool use directly enforces authorization and access restrictions over privileged maintenance functions.
MA-4Nonlocal MaintenanceMAApproving and monitoring nonlocal maintenance per policy enforces access control over remote diagnostic activities.
MA-5Maintenance PersonnelMAEstablishes authorization processes, verification, and supervision to prevent unauthorized access during maintenance activities.
MA-7Field MaintenanceMARestricting field maintenance directly enforces access control over who can interact with or modify the system in uncontrolled environments.
MP-1Policy and ProceduresMPPolicy and procedures establish documented access controls and responsibilities for media, reducing improper access.
MP-2Media AccessMPThe control enforces access restrictions on media, directly mitigating improper access control weaknesses.
MP-3Media MarkingMPMarkings provide explicit guidance on distribution limits and handling caveats, directly supporting enforcement of access controls for physical and logical media.
MP-5Media TransportMPRestricting transport activities to authorized personnel directly enforces proper access control over system media.
MP-7Media UseMPThis control enforces ownership-based restrictions on portable storage device use, directly implementing access control over media insertion into organizational systems.
AT-1Policy and ProceduresATThe awareness and training policy mandates training on access control practices, directly reducing the likelihood of improper access control weaknesses being introduced or exploited.
AT-2Literacy Training and AwarenessATTraining covers access control policies and the consequences of improper access grants or usage by users.
AT-3Role-based TrainingATSecurity training teaches access control policies and enforcement, reducing improper access control implementations.
AT-4Training RecordsATDocumenting role-based training completion allows verification that only trained individuals receive or retain access, making improper access control harder to exploit through untrained personnel.
SI-1Policy and ProceduresSIIntegrity policy and procedures explicitly define and assign responsibilities for access control enforcement, directly reducing unauthorized modification risks.
SI-23Information FragmentationSICompromise of access control on any one system or component still leaves an attacker with only a useless fragment, limiting the practical exploitability of the weakness.
SI-4System MonitoringSIDirectly detects unauthorized local/network/remote connections and system use that result from improper access control.
SI-9Information Input RestrictionsSIDirectly enforces access control by limiting input capability exclusively to authorized personnel.
AU-14Session AuditAUProvides capability to review session content, directly detecting violations of access control.
AU-6Audit Record Review, Analysis, and ReportingAUSystem audit review detects violations of access controls by identifying unauthorized access attempts.
AU-9Protection of Audit InformationAUThe control directly enforces access controls to prevent unauthorized access, modification, or deletion of audit information and tools.
SR-2Supply Chain Risk Management PlanSRExplicit protection of the plan from unauthorized disclosure and modification implements access controls on this sensitive artifact.
SR-7Supply Chain Operations SecuritySROPSEC measures enforce access restrictions on sensitive supply-chain data and processes.
SR-9Tamper Resistance and DetectionSRTamper protection directly detects and resists unauthorized modifications that improper access control would otherwise permit.
IA-13Identity Providers and Authorization ServersIAAuthorization servers centrally manage access rights, preventing improper access control.
IA-4Identifier ManagementIAEnsures identifiers are properly authorized and assigned, supporting effective access control.
IR-10Integrated Information Security Analysis TeamIRThe team provides specialized analysis of access-related incidents, enabling quicker identification and response to unauthorized access attempts.
IR-8Incident Response PlanIRRequiring protection of the plan from unauthorized modification, distribution controls, and explicit designation of incident response responsibilities directly addresses improper access control over this critical resource.

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2012-1723 KEV9.69.80.94082012-06-16
CVE-2012-4681 KEV9.69.80.94142012-08-28
CVE-2013-0422 KEV9.69.80.93612013-01-10
CVE-2016-3427 KEV9.69.80.93892016-04-21
CVE-2023-27350 KEV9.69.80.94262023-04-20
CVE-2023-24489 KEV9.69.80.94392023-07-10
CVE-2024-27348 KEV9.69.80.94342024-04-22
CVE-2011-3544 KEV9.59.80.92542011-10-19
CVE-2012-5076 KEV9.59.80.91712012-10-16
CVE-2023-26360 KEV9.48.60.94332023-03-23
CVE-2021-22941 KEV9.39.80.88492021-09-23
CVE-2019-1653 KEV9.27.50.94382019-01-24
CVE-2023-29298 KEV9.27.50.94292023-07-12
CVE-2023-38205 KEV9.27.50.94182023-09-14
CVE-2024-20767 KEV9.17.40.94042024-03-18
CVE-2020-8193 KEV9.06.50.94392020-07-10
CVE-2023-23752 KEV8.75.30.94522023-02-16
CVE-2014-3120 KEV8.68.10.82602014-07-28
CVE-2025-12480 KEV8.59.10.78322025-11-10
CVE-2013-2423 KEV8.33.70.93402013-04-17
CVE-2022-23134 KEV8.33.70.92612022-01-13
CVE-2025-31125 KEV8.05.30.82102025-03-31
CVE-2019-27297.69.80.94362019-06-19
CVE-2021-214257.49.30.91642021-04-07
CVE-2022-317047.49.80.89842023-01-26