CWEweakness
CWE-799 Improper Control of Interaction Frequency
- Alternate terms
- Insufficient anti-automation, Brute force
- Abstraction
- Class
- Structure
- Simple
- Status
- Incomplete
- Languages
- Not Language-Specific
- CWE version
- 5.0
Description
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
Common consequences
• Availability, Access Control, Other: DoS: Resource Consumption (Other), Bypass Protection Mechanism, Varies by Context — This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. The consequences vary based on the intended logic of the code. For example, humans might be able to vote multiple times in a poll, or to perform password-guessing attacks without any rate limits.
Observed examples
• CVE-2024-50653: Chain: e-commerce product has a "front-end restriction" for coupon use (CWE-602), but the server does not restrict the number of requests for the same coupon (CWE-799)
• CVE-2002-1876: Mail server allows attackers to prevent other users from accessing mail by sending a large number of rapid requests.
Related
Observed example · CVE (2)
- CVE-2024-50653 CRMEB <=5.4.0 is vulnerable to Incorrect Access Control. vulnerability
- CVE-2002-1876 Microsoft Exchange 2000 allows remote authenticated attackers to cause a denial of service via a large number of rapid requests, which… vulnerability
Child of · CWE (1)
- CWE-691 Insufficient Control Flow Management weakness
Referenced by CVE · weakness (93)
- CVE-2026-116123 A weakness has been identified in NocoDB up to 2026.07.0. vulnerability
- CVE-2026-116007 A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. vulnerability
- CVE-2026-115480 baserCMS is a website development framework. vulnerability
- CVE-2026-115359 OpenBao before 2.6.4 and 2.7.x before 2.7.1 contains a flaw in its rate limit quota subsystem where role resolution fails for requests with… vulnerability
- CVE-2026-96364 Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse. vulnerability
- CVE-2026-111874 A flaw has been found in OpenCATS 0.10.0. vulnerability
- CVE-2026-107830 Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by… vulnerability
- CVE-2026-82924 Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. vulnerability
- CVE-2026-97300 Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. vulnerability
- CVE-2026-105237 A vulnerability was detected in linlinjava litemall up to 1.8.0. vulnerability
- CVE-2026-100603 ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated… vulnerability
- CVE-2026-84461 Zammad is a web based open source helpdesk/customer support system. vulnerability
- CVE-2025-13882 IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner… vulnerability
- CVE-2025-36045 IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper… vulnerability
- CVE-2026-93650 A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. vulnerability
- CVE-2026-54594 OmniBlocks is a monorepo for the OmniBlocks project. vulnerability
- CVE-2026-85586 phpMyFAQ versions before 4.1.8 fail to validate CAPTCHA when the store parameter is set to 'now' in question submission requests. vulnerability
- CVE-2026-54738 Lemmy is a link aggregator and forum for the fediverse. vulnerability
- CVE-2026-75773 A vulnerability was found in karakeep-app karakeep up to 0.32.0. vulnerability
- CVE-2026-19895 A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. vulnerability
- CVE-2026-19897 A vulnerability has been found in mangroup dtale up to 3.22.0. vulnerability
- CVE-2026-19898 A vulnerability was found in VictoriaMetrics up to 1.146.0. vulnerability
- CVE-2024-23565 HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password… vulnerability
- CVE-2026-33434 Wazuh is a free and open source platform used for threat prevention, detection, and response. vulnerability
- CVE-2026-5233 Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. vulnerability
- CVE-2026-10216 A vulnerability was detected in unitedbyai droidclaw up to 0.5.3. vulnerability
- CVE-2026-7671 A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. vulnerability
- CVE-2026-7402 Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc. vulnerability
- CVE-2026-41333 OpenClaw before 2026.3.31 contains an authentication rate limiting bypass vulnerability that allows attackers to circumvent shared… vulnerability
- CVE-2026-41343 OpenClaw before 2026.3.31 lacks a shared pre-auth concurrency budget on the public LINE webhook path, allowing attackers to cause transient… vulnerability