CWEweakness

CWE-424 Improper Protection of Alternate Path

Official page ↗
Abstraction
Class
Structure
Simple
Status
Draft
Languages
Not Language-Specific
CWE version
5.0

Description

The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.

Common consequences

• Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity

Potential mitigations

• [Architecture and Design] Deploy different layers of protection to implement security in depth.

Detection methods

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Observed examples

• CVE-2022-29238: Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.

Related

Attack pattern · CAPEC (2)

  • CAPEC-127 Directory Indexing attack pattern
  • CAPEC-554 Functionality Bypass attack pattern

Observed example · CVE (1)

  • CVE-2022-29238 Jupyter Notebook is a web-based notebook environment for interactive computing. vulnerability

Child of · CWE (2)

  • CWE-638 Not Using Complete Mediation weakness
  • CWE-693 Protection Mechanism Failure weakness

Referenced by CAPEC · weakness (2)

  • CAPEC-127 Directory Indexing attack pattern
  • CAPEC-554 Functionality Bypass attack pattern

Referenced by CVE · weakness (47)

  • CVE-2026-89419 OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in… vulnerability
  • CVE-2026-114659 Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes… vulnerability
  • CVE-2026-76529 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… vulnerability
  • CVE-2026-110865 Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repository users to evade the allowedHeaders restriction by… vulnerability
  • CVE-2026-69979 Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally. vulnerability
  • CVE-2026-107352 Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited… vulnerability
  • CVE-2026-89039 A caller who can invoke the convert_playwright_script prompt in mcp-k6 can pass a bare file path as the playwright_script argument and… vulnerability
  • CVE-2026-93353 copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove,… vulnerability
  • CVE-2026-37008 CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than… vulnerability
  • CVE-2026-82586 Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are… vulnerability
  • CVE-2026-82754 Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth… vulnerability
  • CVE-2026-86145 PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching… vulnerability
  • CVE-2026-58428 Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) vulnerability
  • CVE-2026-66756 Improper Protection of Alternate Path vulnerability in Apache Tika. vulnerability
  • CVE-2026-54423 In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use… vulnerability
  • CVE-2026-0268 A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN… vulnerability
  • CVE-2026-0237 An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to… vulnerability
  • CVE-2026-4913 Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access… vulnerability
  • CVE-2026-4270 Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9… vulnerability
  • CVE-2025-68939 Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. vulnerability
  • CVE-2025-4617 An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin… vulnerability
  • CVE-2025-58079 Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create… vulnerability
  • CVE-2025-6250 Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper… vulnerability
  • CVE-2025-49162 Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character… vulnerability
  • CVE-2025-49163 Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file. vulnerability
  • CVE-2025-48827 vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when… vulnerability
  • CVE-2025-48828 Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. vulnerability
  • CVE-2025-46654 CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by… vulnerability
  • CVE-2025-46655 CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be… vulnerability
  • CVE-2024-58136 Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited… vulnerability
Show all 47 ›

Referenced by CWE · child of (1)

Referenced by CWE · has member (1)

  • CWE-1340 CISQ Data Protection Measures view

Referenced by OWASP · mapped cwe (1)

  • A01:2025 Broken Access Control Top 10 2025