CWE-425: Direct Request (Forced Browsing)
Filter
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
What the weakness is: CWE-425 at MITRE. OWASP Top 10: A01:2025 Broken Access Control
Related attack patterns (CAPEC): 5
- CAPEC-87 Forceful Browsing Likelihood: High · Severity: High
- CAPEC-127 Directory Indexing Likelihood: High · Severity: Medium
- CAPEC-143 Detect Unpublicized Web Pages Severity: Low
- CAPEC-144 Detect Unpublicized Web Services Severity: Low
- CAPEC-668 Key Negotiation of Bluetooth Attack (KNOB) Likelihood: Low · Severity: High
The attack patterns MITRE's CAPEC relates to CWE-425, as MITRE names them. Credits.
Ask an AI about CWE-425
Show the prompt
Explain CWE-425: Direct Request and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/425.html and https://cve.bz/cve/cwe/425?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 5.5CVE-2026-112144EPSS 0.5%
A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unknown part of the file project.sql. Executing a manipulation can lead to files or directories accessib…
- 5.5CVE-2026-108938EPSS 0.3%
A flaw has been found in code-projects Matrimonial System 1.0. This issue affects some unknown processing of the file db/matrimony.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely. The exp…
- 9.1CVE-2026-87744EPSS 0.4%
A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explici…
- 4.3CVE-2026-105046EPSS 0.2%
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
- 8.8CVE-2026-80275EPSS 0.3%
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to ove…
- 4.3CVE-2026-102584EPSS 0.2%
A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify gr…
- 2.7CVE-2026-102583EPSS 0.2%
A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web service allows an authenticated user to invoke the feature without holding the required capability. This …
- 4.3CVE-2026-102582EPSS 0.2%
A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, allowing users with enrolment permissions to access the page directly by navigating to its URL. Conse…
- 6.5CVE-2026-40532EPSS 0.4%
A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information.
- 7.4CVE-2026-36453EPSS 0.3%
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.
- 5.5CVE-2026-78051EPSS 0.5%
A vulnerability was determined in alexta69 MeTube up to 2026.06.10. The impacted element is an unknown function of the file /download/.metube/cookies.txt of the component Cookie File Handler. This manipulation causes files or directories a…
- 5.3CVE-2026-14953EPSS 0.3%
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.
- 5.5CVE-2026-76799EPSS 0.5%
A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation…
- 5.5CVE-2026-19903EPSS 0.5%
A vulnerability has been found in SourceCodester Online Clothing Store 1.0. This affects an unknown part of the file /db/shopping.sql of the component SQL Database Backup. The manipulation leads to files or directories accessible. Remote e…
- 6.9CVE-2026-60011EPSS 0.4%
Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product.
- 4.6CVE-2026-21760EPSS 0.2%
HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks may allow unauthorized users to access restricted administrative functionality by directly accessin…
- 3.7CVE-2024-23573EPSS 0.2%
HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. that makes the SS LLUCKY13 possible affects the TLS1.1and 1.2 and DTLS1.0 or 1.2 implementations . It also affects previous versions such as SSL3.…
- 5.5CVE-2026-13533EPSS 0.5%
A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. Affected by this issue is the function Spyc::YAMLLoad of the file /config/config.yaml of the component htaccess Handler. Such manipulation leads to files or d…
- 8.6CVE-2026-10521EPSS 0.6%
An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical program parameters. This can result in a total loss of confidentiality, integrity and availability.
- 5.3CVE-2026-9610EPSS 0.3%
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked in the UI but is accessible by directly requesting the URL, bypassing intended access controls.
- 6.9CVE-2026-34028EPSS 0.4%
The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an authorization scheme. An unauthenticated attacker can directly access HTTP endpoints to download files fr…
- 4.9CVE-2026-11986EPSS 0.3%
A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when de…
- 6.3CVE-2026-8205EPSS 0.2%
Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results in restricted event details being disclosed. The Concrete CMS security te…
- 8.5CVE-2026-42297EPSS 0.5%
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the Sync Service's ConfigMap-backed provider (server/sync/sync_cm.go) performs zer…
- 5.4CVE-2026-7500EPSS 0.2%
When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write o…
- 4.3CVE-2024-58343EPSS 0.2%
Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to vis_client_id.
- 8.7CVE-2026-35029ExploitEPSS 39%
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then us…
- 5.3CVE-2026-29909EPSS 0.5%
MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. The /admin/file/list.do endpoint lacks authentication controls and proper input validation, allowing remote attackers to enumerate …
- 7.1CVE-2025-15381EPSS 0.3%
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the exp…
- 5.5CVE-2026-4900EPSS 0.4%
A weakness has been identified in code-projects Online Food Ordering System 1.0. This affects an unknown part of the file /dbfood/localhost.sql. This manipulation causes files or directories accessible. The attack can be initiated remotely…
- 6.5CVE-2026-34056EPSS 0.3%
OpenEMR is a free and open source electronic health records and medical practice management application. A Broken Access Control vulnerability in OpenEMR up to and including version 8.0.0.3 allows low-privilege users to view and download E…
- 5.4CVE-2026-34051EPSS 0.2%
OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.3 have an improper access control on the Import/Export functionality, allowing unauthorized users to perform i…
- 6.5CVE-2026-33217EPSS 0.3%
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, when using ACLs on message subjects, these ACLs were not applied in the `$MQTT.>` namespace, allowing MQT…
- 5.5CVE-2026-4532EPSS 0.5%
A security vulnerability has been detected in code-projects Simple Food Ordering System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /food/sql/food.sql of the component Database Backup Handler. The mani…
- 9.1CVE-2026-22732EPSS 0.5%
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security Servlet applications using lazy (defaul…
- 5.3CVE-2026-32867EPSS 0.2%
OPEXUS eComplaint before version 10.1.0.0 allows an unauthenticated attacker to obtain or guess an existing case number and upload arbitrary files via 'Portal/EEOC/DocumentUploadPub.aspx'. Users would see these unexpected files in cases. U…
- 8.6CVE-2025-15587EPSS 0.2%
Tinycontrol devices such as tcPDU and LAN Controllers LK3.5, LK3.9 and LK4 allow a low privileged user to read an administrator's password by directly accessing a specific resource inaccessible via a graphical interface. This issue has be…
- 7.5CVE-2026-25679EPSS 0.8%
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
- 5.5CVE-2026-1978EPSS 0.4%
A vulnerability was detected in kalyan02 NanoCMS up to 0.4. Affected by this issue is some unknown functionality of the file /data/pagesdata.txt of the component User Information Handler. Performing a manipulation results in direct request…
- 9.4CVE-2025-52024EPSS 0.5%
A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users. By accessing specific URLs, an attacker is presented with a directory-style index lis…
- 7.5CVE-2026-0790EPSS 0.7%
ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentica…
- 9.3CVE-2026-0650ExploitEPSS 1.5%
OpenFlagr versions prior to and including 1.1.18 contain an authentication bypass vulnerability in the HTTP middleware. Due to improper handling of path normalization in the whitelist logic, crafted requests can bypass authentication and a…
- 2.9CVE-2025-15153EPSS 0.5%
A weakness has been identified in PbootCMS up to 3.2.12. Impacted is an unknown function of the file /data/pbootcms.db of the component SQLite Database. Executing a manipulation can lead to files or directories accessible. It is possible t…
- 4.3CVE-2025-67844EPSS 0.4%
The GitHub Integration API in Mintlify Platform before 2025-11-15 allows remote attackers to obtain sensitive repository metadata via the repository owner and name fields. It fails to validate that the repository owner and name fields prov…
- 7.1CVE-2025-65011EPSS 0.2%
In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in question. The vendor was notified early about this vulnerability, but didn't respo…
- 6.5CVE-2025-26381EPSS 0.3%
Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to sensitive information.
- 2.9CVE-2025-14697EPSS 0.3%
A security flaw has been discovered in Shenzhen Sixun Software Sixun Shanghui Group Business Management System 4.10.24.3. Affected by this issue is some unknown functionality of the file /ExportFiles/. The manipulation results in files or …
- 2.7CVE-2025-57823EPSS 0.2%
A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated…
- 4.3CVE-2025-6195EPSS 0.3%
GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user to view information from security reports under certain co…
- 1.3CVE-2025-62778EPSS 0.2%
Frappe Learning is a learning management system. A security issue was identified in Frappe Learning 2.39.1 and earlier, where students were able to access the Quiz Form if they had the URL.