CAPEC-180

Most commonly, attackers would take advantage of controls that provided too little protection for sensitive activities in order to perform actions that should be denied to them. In some circumstances, an attacker may be able to take advantage of overly restrictive access control policies, initiating denial of services (if an application locks because it unexpectedly failed to be granted access) or causing other legitimate actions to fail due to security. The latter class of attacks, however, is usually less severe and easier to detect than attacks based on inadequate security restrictions. This attack pattern differs from CAPEC 1, "Accessing Functionality Not Properly Constrained by ACLs" in that the latter describes attacks where sensitive functionality lacks access controls, where, in this pattern, the access control is present, but incorrectly configured.

How the attack unfolds

1. Explore

   The attacker looks for a way in.

   1. [Survey] The attacker surveys the target application, possibly as a valid and authenticated user.

      2 techniques

      • Spider the web site for all available links.
      • Brute force to guess all function names/action with different privileges.

2. Experiment

   They probe what they found.

   2. [Identify weak points in access control configurations] The attacker probes the access control for functions and data identified in the Explore phase to identify potential weaknesses in how the access controls are configured.

      3 techniques

      • The attacker attempts authenticated access to targeted functions and data.
      • The attacker attempts unauthenticated access to targeted functions and data.
      • The attacker attempts indirect and side channel access to targeted functions and data.

3. Exploit

   They carry out the attack.

   3. [Access the function or data bypassing the access control] The attacker executes the function or accesses the data identified in the Explore phase bypassing the access control.

      1 technique

      • The attacker executes the function or accesses the data not authorized to them.

Prerequisites

• The target must apply access controls, but incorrectly configure them. However, not all incorrect configurations can be exploited by an attacker. If the incorrect configuration applies too little security to some functionality, then the attacker may be able to exploit it if the access control would be the only thing preventing an attacker's access and it no longer does so. If the incorrect configuration applies too much security, it must prevent legitimate activity and the attacker must be able to force others to require this activity..

Skills required

• Low skill

  In order to discover unrestricted resources, the attacker does not need special tools or skills. They only have to observe the resources or access mechanisms invoked as each action is performed and then try and access those access mechanisms directly.

Resources required

• None: No specialized resources are required to execute this type of attack.

Consequences

Mitigations

• Design: Configure the access control correctly.

Weaknesses it exploits

• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-1190 DMA Device Enabled Too Early in Boot Phase
• CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
• CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
• CWE-1220 Insufficient Granularity of Access Control
• CWE-1268 Policy Privileges are not Assigned Consistently Between Control and Data Agents
• CWE-1280 Access Control Check Implemented After Asset is Accessed
• CWE-1297 Unprotected Confidential Information on Device is Accessible by OSAT Vendors
• CWE-1311 Improper Translation of Security Attributes by Fabric Bridge
• CWE-1315 Improper Setting of Bus Controlling Capability in Fabric End-point
• CWE-1318 Missing Support for Security Features in On-chip Fabrics or Buses
• CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals
• CWE-1321 Improperly Controlled Modification of Object Prototype Attributes

Recent CVEs with these weaknesses

1. 3.9CVE-2026-145432026-11-10

   The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-pr…

2. 7.4CVE-2026-129632026-11-10

   A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server.

3. 7.3CVE-2026-1121252026-11-10

   Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01.

4. 7.1CVE-2026-1097972026-11-10

   In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use …

5. 6.5CVE-2026-1251182026-11-09

   Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validati…

6. 8.2CVE-2026-1251172026-11-09

   Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose can descend into inherited properties while loading database documents in init(), setting do…

7. 7.8CVE-2026-1140312026-11-09

   Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. Th…

8. 8.1CVE-2026-1238032026-11-09

   SuperTokens Core is an open source authentication server. From 10.1.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, loadOptionsById_Transaction and getUserInfoByCredentialId_Transaction perform applicat…

The newest records naming one of them. Each weakness's page lists them all.

Related attack patterns

Part of

• CAPEC-122 Privilege Abuse

Can lead to

• CAPEC-17 Using Malicious Files

More specific patterns

• CAPEC-58 Restful Privilege Elevation
• CAPEC-679 Exploitation of Improperly Configured or Implemented Memory Protections
• CAPEC-680 Exploitation of Improperly Controlled Registers
• CAPEC-681 Exploitation of Improperly Controlled Hardware Security Identifiers
• CAPEC-702 Exploiting Incorrect Chaining or Granularity of Hardware Debug Components

Examples

MITRE's words, unchanged: CAPEC-180 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.