CVE-2023-4560

Directly enforces authorization policy and least privilege for access to sensitive data including indexes.

A.5.12 only defines and communicates a classification scheme (with owners accountable for applying it); it does not itself authorize, enforce, or restrict index access, so the improper authorization weakness and its exploitability remain untouched per the owner's labeling-dependency rule

A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce, implement, or act on those rules to stop exploitation of an improperly authorized search index (per the owner's labeling rule and its positive form: policy/requirements are a dependency for other controls like A.8.3, not a preventer themselves).

A.5.18's provisioning, review, revocation and authorization steps (incl. owner approval, segregation, timely removal on role/employment change) directly enforce that only authorized actors can access the sensitive index, stopping exploitation in most cases; the bounded remainder is flawed index designs that leak outside any access control decision (e.g. via side-channel or mis-indexed public metadata).

Privileged access rights may be used to enforce index restrictions but are not the primary control.

A.8.3 directly restricts index access via configuration mechanisms, per-user/group rights, isolation, dynamic techniques, authentication and encryption, preventing exploitation for the dominant authorization slice of CWE-612; the bounded remainder is flawed index-generation logic itself (e.g. over-inclusion of sensitive docs before any access control is applied).