CWEweakness
CWE-1280 Access Control Check Implemented After Asset is Accessed
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific, VHDL, Verilog
- CWE version
- 5.0
Description
A product's hardware-based access control check occurs after the asset has been accessed.
Extended description
The product implements a hardware-based access control check. The asset should be accessible only after the check is successful. If, however, this operation is not atomic and the asset is accessed before the check is complete, the security of the system may be compromised.
Common consequences
• Access Control, Confidentiality, Integrity: Modify Memory, Read Memory, Modify Application Data, Read Application Data, Gain Privileges or Assume Identity, Bypass Protection Mechanism
Potential mitigations
• [Implementation] Implement the access control check first. Access should only be given to asset if agent is authorized.
Related
Attack pattern · CAPEC (1)
- CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels attack pattern
Child of · CWE (2)
Referenced by CAPEC · weakness (1)
- CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels attack pattern
Referenced by CVE · weakness (3)
- CVE-2026-86341 GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2… vulnerability
- CVE-2026-7487 GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1… vulnerability
- CVE-2026-3607 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.9.7, 18.10 before 18.10.6, and 18.11 before… vulnerability