CVE-2023-3998

Requiring a decision for every access request prevents missing authorization checks that would otherwise allow unauthorized access.

Requiring enforcement of authorizations ensures checks are performed rather than omitted for resources.

Requiring an access control policy ensures authorization checks are defined and applied for critical functions.

Reviews of access controls detect missing authorization checks on critical functions or resources.

Documenting permitted unauthenticated actions prevents missing authorization by making all exceptions explicit and subject to organizational review.

Requiring attribute association with information prevents authorization from being performed without necessary security or privacy context.

Mandating authorization prior to allowing remote connections addresses missing authorization for remote access.

Mandating authorization before wireless connections are allowed prevents missing authorization for wireless access.

Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.

Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.

A.5.15 directly requires defining and implementing access control rules (including authorization, need-to-know, role-based restrictions, formal requests, and consistency with classification) that stop one user from reaching another's data via a tampered key; the bounded remainder is dynamic or application-specific authorization logic (cross-referenced to 8.26) that may still allow bypass if those downstream rules are flawed.

Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.