CWE · MITRE source
CWE-425Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Last updated: 14 October 2026 20:41 UTC
OWASP Top 10 for Web (2025)
This weakness contributes to A01:2025 Broken Access Control.
Control responseHuman-reviewed
Answering this weakness across the control lifecycle, from our framework cross-walks.
NIST 800-53 r5 controls PROPOSED for this weakness (6)AI-assisted
These are model PROPOSALS, not graded mappings. They come
from controls_to_cwe_proposals, which carries no grade field at
all; across the CWE pages 1,540 of 1,722 such associations (89%) have never
been graded by anything. The heading said “address” until
2026-09-29, which asserted a relationship the data does not carry.
Graded cross-walks are on the framework map, not here.
Showing the 5 most specific. Generic controls that address many weakness types are collapsed below.
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
AC-24 | Access Control Decisions | AC | graded mostly Forcing a decision on every access request, including direct ones, reduces the exploitability of forced browsing by ensuring no unchecked access paths. |
AC-3 | Access Enforcement | AC | graded full Enforcing access for all logical requests prevents unauthorized direct access to protected resources. |
AC-25 | Reference Monitor | AC | Forces all accesses through the reference monitor, preventing direct or forced requests that bypass checks. |
SC-26 | Decoys | SC | Decoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis. |
SI-9 | Information Input Restrictions | SI | Blocks unauthorized direct requests or forced browsing by denying input access to non-authorized actors. |
Show 1 more broadly-applicable controls
AC-8 | System Use Notification | AC | Displaying the notification before further access on public systems prevents direct resource requests from bypassing the required system use terms and consent. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2018-19207 UPD | 9.9 | 9.8 | 0.8807 | 2018-11-12 |
CVE-2024-0204 UPD | 9.9 | 9.8 | 0.9509 | 2024-01-22 |
CVE-2017-17736 UPD | 9.8 | 9.8 | 0.6846 | 2018-03-23 |
CVE-2019-12583 UPD | 8.8 | 9.1 | 0.4393 | 2019-06-27 |
CVE-2017-14244 UPD | 8.5 | 9.8 | 0.1715 | 2017-09-17 |
CVE-2019-16340 UPD | 8.5 | 9.8 | 0.1926 | 2019-11-21 |
CVE-2024-45195 KEV UPD | 8.5 | 7.5 | 0.9998 | 2024-09-04 |
CVE-2020-35391 UPD | 8.4 | 9.6 | 0.3525 | 2021-01-01 |
CVE-2021-24215 UPD | 8.2 | 9.8 | 0.0973 | 2021-04-12 |
CVE-2021-36745 UPD | 8.2 | 9.8 | 0.0939 | 2021-09-29 |
CVE-2018-3774 UPD | 7.9 | 10.0 | 0.0381 | 2018-08-12 |
CVE-2019-7736 UPD | 7.8 | 9.8 | 0.0273 | 2019-02-11 |
CVE-2019-9884 UPD | 7.8 | 9.8 | 0.0296 | 2019-07-25 |
CVE-2020-24203 UPD | 7.8 | 9.8 | 0.0374 | 2020-08-27 |
CVE-2021-40875 UPD | 7.8 | 7.5 | 0.4749 | 2021-09-22 |
CVE-2018-18922 UPD | 7.7 | 9.8 | 0.0243 | 2018-12-13 |
CVE-2019-9552 UPD | 7.7 | 9.8 | 0.0204 | 2019-03-04 |
CVE-2019-9584 UPD | 7.7 | 9.8 | 0.0271 | 2019-08-14 |
CVE-2019-14927 UPD | 7.7 | 7.5 | 0.4088 | 2019-10-28 |
CVE-2020-24660 UPD | 7.7 | 9.8 | 0.0236 | 2020-09-14 |
CVE-2019-12768 UPD | 7.7 | 9.8 | 0.0232 | 2020-12-30 |
CVE-2022-28799 UPD | 7.7 | 8.8 | 0.1603 | 2022-06-02 |
CVE-2018-6624 UPD | 7.6 | 9.8 | 0.0165 | 2018-02-05 |
CVE-2021-36560 UPD | 7.6 | 9.8 | 0.0153 | 2021-11-02 |
CVE-2022-26279 UPD | 7.6 | 9.8 | 0.0184 | 2022-03-24 |