CVE-2023-3426

Requiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.

Always invoking the reference monitor prevents missing authorization checks for protected resources.

Requiring enforcement of authorizations ensures checks are performed rather than omitted for resources.

Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.

Prevents missing authorization checks for input operations by restricting the capability itself.

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

Access control policy directly requires authorization checks on all resources, preventing forced browsing.

Managing access rights ensures every URL/script/file is explicitly authorized, mitigating direct request attacks.

Segregating the approval of access rights from their implementation provides an independent check that reduces the impact of missing authorization checks in the resulting system configuration.

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.