Cyber Resilience

CWE · MITRE source

CWE-425Direct Request ('Forced Browsing')

Abstraction: Base · CVEs in our corpus: 239

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

Last updated: 20 August 2026 13:14 UTC

Cumulative inbound coverage

How completely the frameworks we cross-walk collectively cover this — the verdict is the strongest single mapping (overlapping partials are not summed); breadth shows the corroboration behind it.

Collective: full · 3 mapping(s) from 1 framework(s): CAPEC 3 (full)

See the full cumulative-coverage rollup →

OWASP Top 10 for Web (2025)

This weakness contributes to A01:2025 Broken Access Control.

Control responseHuman-reviewed

Answering this weakness across the control lifecycle, from our framework cross-walks.

Prevent
Stop it (NIST 800-53 / CSF Protect)
  • AC-24 Access Control Decisions
  • AC-25 Reference Monitor
  • AC-3 Access Enforcement
  • AC-8 System Use Notification
Detect
Catch it (CSF Detect / Respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)

—

NIST 800-53 r5 controls that address this weakness (6)AI-assisted

Showing the 5 most specific. Generic controls that address many weakness types are collapsed below.

Control Title Family Why it addresses this CWE
AC-24Access Control DecisionsACForcing a decision on every access request, including direct ones, reduces the exploitability of forced browsing by ensuring no unchecked access paths.
AC-25Reference MonitorACForces all accesses through the reference monitor, preventing direct or forced requests that bypass checks.
AC-3Access EnforcementACEnforcing access for all logical requests prevents unauthorized direct access to protected resources.
SC-26DecoysSCDecoy endpoints catch forced browsing and direct requests, deflecting attackers from legitimate resources while enabling analysis.
SI-9Information Input RestrictionsSIBlocks unauthorized direct requests or forced browsing by denying input access to non-authorized actors.
Show 1 more broadly-applicable controls
AC-8System Use NotificationACDisplaying the notification before further access on public systems prevents direct resource requests from bypassing the required system use terms and consent.

MITRE ATT&CK techniques this weakness enables

Our own two-way CWE↔ATT&CK cross-walk — a direct mapping with no public source (the CWE→CAPEC→ATT&CK chain leaves most top weaknesses, incl. XSS and SQLi, mapped to nothing).

Direction: ← other covers this; → this covers other (F/M/P = full / mostly / partial). gov = governs / implements (a mandate, not coverage).

T1083 File and Directory Discovery→P

Top CVEs of this weakness type, ranked by Risk Priority

CVE Risk CVSS EPSS Published
CVE-2018-19207 9.99.80.88072018-11-12
CVE-2024-0204 9.99.80.95092024-01-22
CVE-2017-17736 9.89.80.68962018-03-23
CVE-2019-12583 8.89.10.43932019-06-27
CVE-2017-14244 8.59.80.17152017-09-17
CVE-2019-16340 8.59.80.19262019-11-21
CVE-2024-45195 KEV 8.57.50.99982024-09-04
CVE-2020-35391 8.49.60.35002021-01-01
CVE-2021-24215 8.29.80.09732021-04-12
CVE-2021-36745 8.29.80.09392021-09-29
CVE-2026-35029 8.08.80.26412026-04-06
CVE-2018-3774 7.910.00.03812018-08-12
CVE-2021-40875 7.97.50.48422021-09-22
CVE-2019-7736 7.89.80.02732019-02-11
CVE-2019-9884 7.89.80.02962019-07-25
CVE-2020-24203 7.89.80.03742020-08-27
CVE-2018-18922 7.79.80.02432018-12-13
CVE-2019-9552 7.79.80.02042019-03-04
CVE-2019-9584 7.79.80.02712019-08-14
CVE-2019-14927 7.77.50.41852019-10-28
CVE-2020-24660 7.79.80.02342020-09-14
CVE-2019-12768 7.79.80.02292020-12-30
CVE-2022-28799 7.78.80.16032022-06-02
CVE-2018-6624 7.69.80.01652018-02-05
CVE-2021-36560 7.69.80.01482021-11-02