---
title: "Improper Access"
description: "HawkScan test information for plugin 422000: Improper Access"
url: https://docs.stackhawk.com/vulnerabilities/422000/
---

[Back to Index](https://docs.stackhawk.com/vulnerabilities/)

# Improper Access

###### Reference

- **Plugin ID:** 422000
- **Risk:** High
- **Type:** Active
- **Category:**

### Remediation

To address the vulnerability of "Improper Access" in an OpenAPI specification, consider implementing these measures:

1. **Implement Proper Access Control Mechanisms:** Use OpenAPI security schemes to establish robust authentication and authorization. Define security requirements for each operation. For example, use API keys or OAuth2 for secure endpoint access.

   ```yaml
   securitySchemes:
     ApiKeyAuth:
       type: apiKey
       in: header
       name: X-API-KEY
   paths:
     /user/data:
       get:
         security:
           - ApiKeyAuth: []
   ```

2. **Follow the Principle of Least Privilege:** Assign minimum necessary privileges in your API. Define different scopes for varied roles and restrict access to sensitive endpoints.

3. **Regularly Review and Update Access Control Configurations:** Conduct audits and update your OpenAPI spec to rectify any incorrect access control settings, ensuring compliance with security policies.

4. **Apply Secure Defaults:** Define secure defaults in your API configuration. Restrict access to sensitive resources by default and require explicit privileges for access.

5. **Perform Input Validation:** Validate all user inputs in your API to prevent unauthorized access attempts. Use schemas to define allowed inputs and patterns for requests.

   ```yaml
   parameters:
     - name: userId
       in: query
       required: true
       schema:
         type: integer
   ```

6. **Regularly Update and Patch the Product:** Stay updated with security patches and apply them to your API infrastructure to mitigate access control vulnerabilities.

### About

"Improper Access" occurs when an API fails to restrict unauthorized access to resources. It involves ensuring authentication, authorization, and accountability. Weaknesses in these mechanisms can lead to privilege escalation, data breaches, or unauthorized actions.

There are two behaviors introducing weaknesses: Specification (incorrect privileges, permissions) and Enforcement (errors in access control mechanism).

### Risks

Risks of "Improper Access" include unauthorized access, privilege escalation, information disclosure, command execution, and evasion of detection. Addressing this vulnerability is crucial for the security of the API and its resources.