CVE-2023-26689

PS-4 enforces timely disabling and removal of access upon termination, addressing a key failure mode of incorrect ongoing user management.

Access control policies rely on accurate user management but do not themselves define user lifecycle processes.

A.5.16 directly governs identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) which stops most incorrect-user-management flaws from being exploitable; bounded remainder exists for flawed access-rights assignment logic after identity is issued (belongs to A.8.3).

A.5.18 directly governs the full provisioning, review, adjustment and timely revocation lifecycle for access rights (including segregation, authorization, activation only after approval, and pre-termination review), which stops most incorrect-user-management cases from being exploitable; the bounded remainder is flawed user-lifecycle logic inside the product itself that the organizational process cannot reach.

A.6.5 defines post-termination responsibilities, confidentiality duties, role handovers and communication processes; it has no bearing on whether a product correctly manages users in its environment, so the weakness can still be present and exploitable.

A.8.2 directly controls allocation, review, expiry, temporary use, separate identities and higher authentication for privileged rights per 5.15 policy, which stops most incorrect-user-management cases (e.g. over-provisioned or stale privileges) from being exploitable; the bounded remainder is incorrect management that is not privilege-related at all (e.g. ordinary user creation, password resets, or account lockout logic).