CAPEC-1
Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs: how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/1.html and https://cve.bz/cve/capec/1?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Survey] The attacker surveys the target application, possibly as a valid and authenticated user
4 techniques
- Spidering web sites for all available links
- Brute force guessing of resource names
- Brute force guessing of user names / credentials
- Brute force guessing of function names / actions
[Identify Functionality] At each step, the attacker notes the resource or functionality access mechanism invoked upon performing specific actions
3 techniques
- Use the web inventory of all forms and inputs and apply attack data to those inputs.
- Use a packet sniffer to capture and record network traffic
- Execute the software in a debugger and record API calls into the operating system or important libraries. This might occur in an environment other than a production environment, in order to find weaknesses that can be exploited in a production environment.
Experiment
They probe what they found.
[Iterate over access capabilities] Possibly as a valid user, the attacker then tries to access each of the noted access mechanisms directly in order to perform functions not constrained by the ACLs.
1 technique
- Fuzzing of API parameters (URL parameters, OS API parameters, protocol parameters)
Prerequisites
The application must be navigable in a manner that associates elements (subsections) of the application with ACLs.
The various resources, or individual URLs, must be somehow discoverable by the attacker
The administrator must have forgotten to associate an ACL or has associated an inappropriately permissive ACL with a particular navigable resource.
Skills required
- Low skill
In order to discover unrestricted resources, the attacker does not need special tools or skills. They only have to observe the resources or access mechanisms invoked as each action is performed and then try and access those access mechanisms directly.
Resources required
None: No specialized resources are required to execute this type of attack.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Gain Privileges | Confidentiality, Access Control, Authorization |
Mitigations
In a J2EE setting, administrators can associate a role that is impossible for the authenticator to grant users, such as "NoAccess", with all Servlets to which access is guarded by a limited number of servlets visible to, and accessible by, the user.
Having done so, any direct access to those protected Servlets will be prohibited by the web container.
In a more general setting, the administrator must mark every resource besides the ones supposed to be exposed to the user as accessible by a role impossible for the user to assume. The default security setting must be to deny access and then grant access only to those resources intended by business logic.
Weaknesses it exploits
- CWE-276 Incorrect Default Permissions
- CWE-285 Improper Authorization
- CWE-434 Unrestricted Upload of File with Dangerous Type
- CWE-693 Protection Mechanism Failure
- CWE-732 Incorrect Permission Assignment for Critical Resource
- CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
- CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
- CWE-1220 Insufficient Granularity of Access Control
- CWE-1297 Unprotected Confidential Information on Device is Accessible by OSAT Vendors
- CWE-1311 Improper Translation of Security Attributes by Fabric Bridge
- CWE-1314 Missing Write Protection for Parametric Data Values
- CWE-1315 Improper Setting of Bus Controlling Capability in Fabric End-point
- CWE-1318 Missing Support for Security Features in On-chip Fabrics or Buses
- CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes
- CWE-1327 Binding to an Unrestricted IP Address
Recent CVEs with these weaknesses
- –CVE-2026-97849
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the service is enabled, a remote attacker with network access can connect to the database server and read or modify data. Us…
- –CVE-2026-111249
The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket connections from any origin. A network attacker, or a web page visited by the developer, can observe the names of change…
- 7.8CVE-2026-121267
Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects eta-remote: from 0.0.2 before 0.0.3.
- 9.2CVE-2026-112136
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener…
- 6.9CVE-2026-60045
A high privileged remote attacker can upload arbitrary files to a guessable location. This can result in a loss of availability and might be chained with other vulnerabilities.
- 3.9CVE-2026-14543
The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-pr…
- 7.4CVE-2026-12963
A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.
- 7.3CVE-2026-112125
Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
Implementing the Model-View-Controller (MVC) within Java EE's Servlet paradigm using a "Single front controll…
Implementing the Model-View-Controller (MVC) within Java EE's Servlet paradigm using a "Single front controller" pattern that demands that brokered HTTP requests be authenticated before hand-offs to other Action Servlets.
If no security-constraint is placed on those Action Servlets, such that positively no one can access them, the front controller can be subverted.
MITRE's words, unchanged: CAPEC-1 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.