CWE-612 (通过私有数据的索引导致的信息暴露) — Vulnerability Class 9

CWE-612 represents a critical access control weakness where systems create searchable indexes of sensitive documents but fail to enforce authorization checks on the index itself. Attackers typically exploit this by querying the public-facing search index to retrieve metadata, file paths, or snippets from restricted documents, effectively bypassing the underlying security controls that protect the original files. This vulnerability arises because the index often operates independently of the document’s permission settings, allowing unauthorized users to discover and access private information through search results. To prevent this, developers must ensure that authorization mechanisms are consistently applied to both the source documents and their corresponding indexes. Implementing robust access control lists for index entries and validating user permissions before returning search results are essential steps to mitigate this risk and maintain data confidentiality.