CVE-2023-3426

Requiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.

Always invoking the reference monitor prevents missing authorization checks for protected resources.

Requiring enforcement of authorizations ensures checks are performed rather than omitted for resources.

Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.

Prevents missing authorization checks for input operations by restricting the capability itself.

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

Directly requires policy-driven definition, enforcement, and review of authorizations on resources such as URLs.

Protects environments from unauthorized logical access, which includes preventing direct requests to restricted paths.

A.5.15 directly requires defining/implementing access control rules, authorization, need-to-know, and restrictions that enforce appropriate access on all URLs/resources, which stops forced browsing exploitation even if the flaw remains; remainder is bounded to non-authorization cases like path traversal or CSRF (per AC-3 anchor).

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.