CWEweakness
CWE-425 Direct Request
- Alternate terms
- Forced Browsing
- Abstraction
- Base
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Common consequences
• Confidentiality, Integrity, Availability, Access Control: Read Application Data, Modify Application Data, Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity
Potential mitigations
• [Architecture and Design, Operation] Apply appropriate access control authorizations for each access to all restricted URLs, scripts or files.
• [Architecture and Design] Consider using MVC based frameworks such as Struts.
Observed examples
• CVE-2022-29238: Access-control setting in web-based document collaboration tool is not properly implemented by the code, which prevents listing hidden directories but does not prevent direct requests to files in those directories.
• CVE-2004-2144: Bypass authentication via direct request.
• CVE-2005-1892: Infinite loop or infoleak triggered by direct requests.
• CVE-2004-2257: Bypass auth/auth via direct request.
• CVE-2005-1688: Direct request leads to infoleak by error.
• CVE-2005-1697: Direct request leads to infoleak by error.
• CVE-2005-1698: Direct request leads to infoleak by error.
• CVE-2005-1685: Authentication bypass via direct request.
• CVE-2005-1827: Authentication bypass via direct request.
• CVE-2005-1654: Authorization bypass using direct request.
• CVE-2005-1668: Access privileged functionality using direct request.
• CVE-2002-1798: Upload arbitrary files via direct request.
Related
Attack pattern · CAPEC (5)
Observed example · CVE (12)
- CVE-2022-29238 Jupyter Notebook is a web-based notebook environment for interactive computing. vulnerability
- CVE-2005-1892 FlatNuke 2.5.3 allows remote attackers to cause a denial of service or obtain sensitive information via (1) a direct request to… vulnerability
- CVE-2005-1827 D-Link DSL-504T allows remote attackers to bypass authentication and gain privileges, such as upgrade firmware, restart the router or… vulnerability
- CVE-2005-1697 The RSS module in PostNuke 0.750 and 0.760RC2 and RC3 allows remote attackers to obtain sensitive information via a direct request to… vulnerability
- CVE-2005-1698 PostNuke 0.750 and 0.760RC3 allows remote attackers to obtain sensitive information via a direct request to (1) theme.php or (2)… vulnerability
- CVE-2005-1685 episodex guestbook allows remote attackers to bypass authentication and edit scripts via a direct request to admin.asp. vulnerability
- CVE-2005-1688 Wordpress 1.5 and earlier allows remote attackers to obtain sensitive information via a direct request to files in (1) wp-content/themes/,… vulnerability
- CVE-2005-1654 Hosting Controller 6.1 Hotfix 1.9 and earlier allows remote attackers to register arbitrary users via a direct request to addsubsite.asp… vulnerability
- CVE-2005-1668 YusASP Web Asset Manager 1.0 allows remote attackers to gain privileges via a direct request to assetmanager.asp. vulnerability
- CVE-2004-2144 Baal Smart Forms before 3.2 allows remote attackers to bypass authentication and obtain system access via a direct request to regadmin.php. vulnerability
- CVE-2004-2257 phpMyFAQ 1.4.0 allows remote attackers to access the Image Manager to upload or delete images without authorization via a direct request. vulnerability
- CVE-2002-1798 MidiCart PHP, PHP Plus, and PHP Maxi allows remote attackers to (1) upload arbitrary php files via a direct request to admin/upload.php or… vulnerability
Can precede · CWE (2)
Child of · CWE (3)
Referenced by CAPEC · weakness (5)
Referenced by CVE · weakness (250)
- CVE-2026-112144 A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. vulnerability
- CVE-2026-108938 A flaw has been found in code-projects Matrimonial System 1.0. vulnerability
- CVE-2026-87744 A flaw was found in Quarkus REST Data Panache. vulnerability
- CVE-2026-105046 Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints. vulnerability
- CVE-2026-80275 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an… vulnerability
- CVE-2026-102582 A flaw was found in Moodle. vulnerability
- CVE-2026-102583 A flaw was found in Moodle. vulnerability
- CVE-2026-102584 A flaw was found in Moodle. vulnerability
- CVE-2026-40532 A direct request ('forced browsing') vulnerability in Wallpaper Path in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,… vulnerability
- CVE-2026-36453 Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. vulnerability
- CVE-2026-78051 A vulnerability was determined in alexta69 MeTube up to 2026.06.10. vulnerability
- CVE-2026-14953 A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint… vulnerability
- CVE-2026-76799 A weakness has been identified in code-projects Login Registration System 1.0. vulnerability
- CVE-2026-19903 A vulnerability has been found in SourceCodester Online Clothing Store 1.0. vulnerability
- CVE-2026-60011 Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the… vulnerability
- CVE-2024-23573 HCL Aftermarket EPC is vulnerable to attack since the Application is vulnerable to Lucky 13. vulnerability
- CVE-2026-21760 HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. vulnerability
- CVE-2026-13533 A security vulnerability has been detected in agentejo Cockpit CMS up to 0.12.2. vulnerability
- CVE-2026-10521 An high privileged remote attacker can access a hidden configuration method, that should not be accessible by any user, to modify critical… vulnerability
- CVE-2026-9610 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 exposes resources or functionality that isn't linked… vulnerability
- CVE-2026-34028 The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, exposes web-accessible file paths that are not protected by an… vulnerability
- CVE-2026-11986 A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. vulnerability
- CVE-2026-8205 Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on… vulnerability
- CVE-2026-42297 Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. vulnerability
- CVE-2026-7500 When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. vulnerability
- CVE-2024-58343 Vision Helpdesk before 5.7.0 (patched in 5.6.10) allows attackers to read user profiles via modified serialized cookie data to… vulnerability
- CVE-2026-35029 LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. vulnerability
- CVE-2026-29909 MRCMS V3.1.2 contains an unauthenticated directory enumeration vulnerability in the file management module. vulnerability
- CVE-2025-15381 In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by… vulnerability
- CVE-2026-34051 OpenEMR is a free and open source electronic health records and medical practice management application. vulnerability