CVE-2026-101891

Defines account types, assigns/removes access, and reviews accounts to ensure only authorized actors can reach resources.

Directly enforces approved authorizations for logical access, stopping unauthorized actors from reaching resources.

Enforces flow-control policies that restrict information movement between subjects and objects.

Documents duties and assigns access so that no single account can bypass intended restrictions.

Limits each account to the minimum privileges needed, reducing the chance of unauthorized access.

Requires unique identification and authentication of devices before establishing a communications session.

Documenting authorized flows helps define intended endpoints but does not enforce channel restrictions at runtime.

PR.AA-01 supplies managed identities/credentials that support but do not implement access-control decisions, so it only partially prevents CWE-284 in either direction.

Authentication directly blocks unauthenticated actors (partial prevention of CWE-284) but leaves authorization logic, policy enforcement, and role checks untouched, so the control neither eliminates nor fully mitigates the broader weakness.

A.5.1 only requires that an information security policy and topic-specific policies (including on access control) exist and are reviewed; it does not itself enforce, implement or act on any access restriction, so the weakness can still be exploited (per the owner's explicit rule that governance/dependency clauses score none on effect verbs).

A.5.15 directly mandates determining requirements, defining/implementing topic-specific access control policy+rules (with explicit references to 8.3, 5.16, 5.18), and enforcing authorized access while preventing unauthorized access, which squarely stops exploitation of most CWE-284 instances; the bounded remainder is the physical slice (explicitly delegated to 7.2-7.4) plus any second-order defects like path traversal that are not authorization decisions.

A.5.16's identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) directly stops most improper access by ensuring the actor in an access decision is correctly identified and authorized; the bounded remainder is non-identity mechanisms in CWE-284 such as path traversal or CSRF that do not turn on actor identity at all.

A.5.18 directly governs the provisioning, review, adjustment and timely revocation of both physical and logical access rights per business rules, segregation of duties and risk-evaluated changes/terminations; this stops most unauthorized-actor exploitation paths named by CWE-284, with a bounded remainder (e.g. path-traversal or CSRF cases that are not authorization decisions at all)

A.5.2 defines and assigns roles/responsibilities for protection of information and risk acceptance; it does not itself enforce any access decision and cannot stop exploitation of improper access control (per the owner's labeling rule: governance/dependency clauses do not score on prevent/mitigate verbs)

Ongoing audits and performance reviews of suppliers detect and correct situations where access controls or privilege assignments are weaker than contractually required, limiting an attacker's ability to exploit improper access control in the supplier's environment.