CVE-2026-102780

AC-24 mandates that access control decisions are applied to each request, preventing bypass of authorization logic.

AC-25 requires a tamperproof, always-invoked reference monitor that ensures authorization checks cannot be omitted.

AC-3 directly requires enforcement of authorization decisions on every access request, structurally eliminating missing authorization checks.

Limits the set of modifiable attributes a subject is authorized to touch.

Validates incoming attribute names and values so that only explicitly allowed fields are accepted for update.

Secure SDLC practices directly require allow-listing of mutable object attributes and input validation to block mass-assignment flaws.

Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.

A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).

By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.