Improper Access Control
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-284: Improper Access Control |
| OWASP | A05:2017 - Broken Access Control |
| Confidence Level | Medium |
| Impact Level | Medium |
| Likelihood Level | Medium |
Description#
Using :except with skip_before_filter, skip_before_action, or skip_filter in Rails controllers can unintentionally disable important security checks for most actions, increasing the risk of access control mistakes. It’s safer to explicitly specify which actions should skip filters using :only.
Impact#
If exploited, attackers may gain unauthorized access to sensitive controller actions that should be protected, leading to data leaks, privilege escalation, or unauthorized operations. This can compromise user data and application integrity.