Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5659 vulnerabilities reference this CWE, most recent first.
GHSA-5VFW-JC4P-FJ39
Vulnerability from github – Published: 2026-07-22 12:32 – Updated: 2026-07-22 22:30
VLAI
Summary
Duplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
Details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-q5xf-xhwf-cwqf. This link is maintained to preserve external references.
Original Description
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 2.29.8"
},
"package": {
"ecosystem": "npm",
"name": "n8n"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T22:30:28Z",
"nvd_published_at": "2026-07-22T12:18:19Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-q5xf-xhwf-cwqf. This link is maintained to preserve external references.\n\n## Original Description\n\nn8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user\u0027s workflow, and obtain a valid token. The workflow then runs in the owner\u0027s project context with the owner\u0027s stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner\u0027s connected integrations), breaking user and project isolation.",
"id": "GHSA-5vfw-jc4p-fj39",
"modified": "2026-07-22T22:30:28Z",
"published": "2026-07-22T12:32:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q5xf-xhwf-cwqf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-65594"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/n8n-before-missing-oauth-authorization-check"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: Member-Level Users Can Execute Other Users\u0027 MCP Server Trigger Workflows via Missing OAuth Authorization Check",
"withdrawn": "2026-07-22T22:30:28Z"
}
GHSA-5VHW-XQ26-5FWW
Vulnerability from github – Published: 2024-10-26 00:32 – Updated: 2024-11-01 09:30
VLAI
Details
WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-48237"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T22:15:02Z",
"severity": "CRITICAL"
},
"details": "WTCMS 1.0 is vulnerable to Incorrect Access Control in \\Common\\Controller\\HomebaseController.class.php.",
"id": "GHSA-5vhw-xq26-5fww",
"modified": "2024-11-01T09:30:44Z",
"published": "2024-10-26T00:32:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-48237"
},
{
"type": "WEB",
"url": "https://github.com/taosir/wtcms/issues/15"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5VM6-HP43-Q7FH
Vulnerability from github – Published: 2025-05-07 21:31 – Updated: 2025-05-07 21:31
VLAI
Details
Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager.
The vulnerability could allow authenticated users to change their password without providing their old password.
This issue affects Operations Bridge Manager: 24.2, 24.4.
Severity
{
"affected": [],
"aliases": [
"CVE-2025-3272"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-07T19:16:08Z",
"severity": "MODERATE"
},
"details": "Incorrect Authorization vulnerability in OpenText\u2122 Operations Bridge Manager.\u00a0\n\nThe vulnerability could allow authenticated users to change their password without providing their old password.\n\nThis issue affects Operations Bridge Manager: 24.2, 24.4.",
"id": "GHSA-5vm6-hp43-q7fh",
"modified": "2025-05-07T21:31:45Z",
"published": "2025-05-07T21:31:45Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-3272"
},
{
"type": "WEB",
"url": "https://portal.microfocus.com/s/article/KM000040405"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:C/RE:L/U:Green",
"type": "CVSS_V4"
}
]
}
GHSA-5VPG-XW87-4738
Vulnerability from github – Published: 2025-11-15 09:30 – Updated: 2025-11-15 09:30
VLAI
Details
An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circumstances, could have allowed an attacker to remove Duo flows of another user.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-11865"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-15T08:15:43Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab EE affecting all versions from 18.1 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that, under certain circumstances, could have allowed an attacker to remove Duo flows of another user.",
"id": "GHSA-5vpg-xw87-4738",
"modified": "2025-11-15T09:30:25Z",
"published": "2025-11-15T09:30:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11865"
},
{
"type": "WEB",
"url": "https://about.gitlab.com/releases/2025/11/12/patch-release-gitlab-18-5-2-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/561399"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5VX9-J5CW-47VQ
Vulnerability from github – Published: 2023-02-17 18:30 – Updated: 2023-03-01 01:35
VLAI
Summary
Privilege escalation in MOSN
Details
Authentication vulnerability in MOSN before v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.
Severity
9.8 (Critical)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "mosn.io/mosn"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.23.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-32163"
],
"database_specific": {
"cwe_ids": [
"CWE-178",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-02-17T20:47:37Z",
"nvd_published_at": "2023-02-17T18:15:00Z",
"severity": "CRITICAL"
},
"details": "Authentication vulnerability in MOSN before v.0.23.0 allows attacker to escalate privileges via case-sensitive JWT authorization.",
"id": "GHSA-5vx9-j5cw-47vq",
"modified": "2023-03-01T01:35:47Z",
"published": "2023-02-17T18:30:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-32163"
},
{
"type": "WEB",
"url": "https://github.com/mosn/mosn/issues/1633"
},
{
"type": "WEB",
"url": "https://github.com/mosn/mosn/pull/1637"
},
{
"type": "PACKAGE",
"url": "https://github.com/mosn/mosn"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Privilege escalation in MOSN"
}
GHSA-5W89-2C2X-6X66
Vulnerability from github – Published: 2026-04-08 03:32 – Updated: 2026-07-09 15:31
VLAI
Details
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2026-27140"
],
"database_specific": {
"cwe_ids": [
"CWE-641",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T02:16:02Z",
"severity": "HIGH"
},
"details": "SWIG file names containing \u0027cgo\u0027 and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.",
"id": "GHSA-5w89-2c2x-6x66",
"modified": "2026-07-09T15:31:57Z",
"published": "2026-04-08T03:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27140"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27140.json"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4871"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"type": "WEB",
"url": "https://go.dev/issue/78335"
},
{
"type": "WEB",
"url": "https://go.dev/cl/763768"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456341"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-27140"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34099"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25182"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23246"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16698"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16697"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16694"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16498"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16497"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16494"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16024"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:16021"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10704"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10219"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10217"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5W9G-VRJ4-XWGH
Vulnerability from github – Published: 2022-05-24 19:06 – Updated: 2022-07-13 00:01
VLAI
Details
IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.
Severity
4.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2021-29751"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-28T16:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Business Automation Workflow 18.0, 19.0, and 20.0 and IBM Business Process Manager 8.5 and 8.6 could allow an authenticated user to obtain sensitive information about another user under nondefault configurations. IBM X-Force ID: 201779.",
"id": "GHSA-5w9g-vrj4-xwgh",
"modified": "2022-07-13T00:01:17Z",
"published": "2022-05-24T19:06:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-29751"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/201779"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6465127"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6467055"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-5W9H-X2V4-5XM7
Vulnerability from github – Published: 2022-11-19 00:30 – Updated: 2022-11-24 06:30
VLAI
Details
Carel Boss Mini 1.5.0 has Improper Access Control.
Severity
9.9 (Critical)
{
"affected": [],
"aliases": [
"CVE-2022-34827"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-11-18T23:15:00Z",
"severity": "CRITICAL"
},
"details": "Carel Boss Mini 1.5.0 has Improper Access Control.",
"id": "GHSA-5w9h-x2v4-5xm7",
"modified": "2022-11-24T06:30:20Z",
"published": "2022-11-19T00:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34827"
},
{
"type": "WEB",
"url": "https://github.com/mandiant/Vulnerability-Disclosures"
},
{
"type": "WEB",
"url": "https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0040/MNDT-2022-0040.md"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-5WG2-J2CF-G3Q5
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43
VLAI
Details
A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.
{
"affected": [],
"aliases": [
"CVE-2021-26964"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-05T17:15:00Z",
"severity": "HIGH"
},
"details": "A remote authentication restriction bypass vulnerability was discovered in Aruba AirWave Management Platform version(s): Prior to 8.2.12.0. A vulnerability in the AirWave web-based management interface could allow an authenticated remote attacker to improperly access and modify devices and management user details. A successful exploit would consist of an attacker using a lower privileged account to change management user or device details. This could allow the attacker to escalate privileges and/or change network details that they should not have access to.",
"id": "GHSA-5wg2-j2cf-g3q5",
"modified": "2022-05-24T17:43:46Z",
"published": "2022-05-24T17:43:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26964"
},
{
"type": "WEB",
"url": "https://www.arubanetworks.com/assets/alert/ARUBA-PSA-2021-005.txt"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-5WJ5-87VQ-39XM
Vulnerability from github – Published: 2026-04-09 17:35 – Updated: 2026-06-08 23:24
VLAI
Summary
OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement
Details
Impact
Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement.
A previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path.
OpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected versions:
<=2026.4.5 - Patched versions:
2026.4.8
Fix
The issue was fixed on main and is available in the patched npm version listed above. The verified fixed tree is commit d7c3210cd6f5fdfdc1beff4c9541673e814354d5.
Verification
The fix was re-checked against main before publication, including targeted regression tests for the affected security boundary.
Credits
Thanks @zsxsoft and @KeenSecurityLab for reporting.
Severity
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.4.8"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42432"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-09T17:35:53Z",
"nvd_published_at": "2026-04-28T19:37:47Z",
"severity": "HIGH"
},
"details": "## Impact\n\nNode Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement.\n\nA previously paired node could reconnect with a broader command set, including exec-capable commands, without forcing the operator/admin re-pairing path.\n\nOpenClaw is a user-controlled local assistant. This advisory is scoped to the OpenClaw trust model and does not assume a multi-tenant service boundary.\n\n## Affected Packages / Versions\n\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c=2026.4.5`\n- Patched versions: `2026.4.8`\n\n## Fix\n\nThe issue was fixed on `main` and is available in the patched npm version listed above. The verified fixed tree is commit `d7c3210cd6f5fdfdc1beff4c9541673e814354d5`.\n\n## Verification\n\nThe fix was re-checked against `main` before publication, including targeted regression tests for the affected security boundary.\n\n## Credits\n\nThanks @zsxsoft and @KeenSecurityLab for reporting.",
"id": "GHSA-5wj5-87vq-39xm",
"modified": "2026-06-08T23:24:37Z",
"published": "2026-04-09T17:35:53Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5wj5-87vq-39xm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42432"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/d7c3210cd6f5fdfdc1beff4c9541673e814354d5"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openclaw-command-escalation-via-node-pairing-reconnect-bypass"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Node Pairing Reconnect Command Escalation Bypasses operator.admin Scope Requirement"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.