What CVEs are caused by CWE-183?

38 recorded CVEs are attributed to CWE-183, including CVE-2026-3490, CVE-2026-42043, CVE-2025-53762.

What are the consequences of CWE-183?

Exploiting CWE-183 can lead to: Bypass Protection Mechanism.

Is CWE-183 actively exploited?

38 recorded CVEs are caused by CWE-183; none are currently in CISA's KEV catalog of actively exploited flaws.

RadicalNotion.AI

Log in Start free

Base weakness

Draft

CWE-183: Permissive List of Allowed Inputs

Also known as: Allowlist / Allow List, Safelist / Safe List, Whitelist / White List

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.

Last updated May 1, 2026

38

Recorded CVEs

With this primary weakness

0

KEVs

In the CISA KEV catalog

Not rated

Likelihood of exploit

Per MITRE

Base

Abstraction

MITRE classification

Overview

CWE-183 (Permissive List of Allowed Inputs) is a base-level software weakness catalogued by MITRE in the Common Weakness Enumeration (CWE). It describes a recurring type of mistake that can lead to exploitable security vulnerabilities.

Real-world CVEs

38 recorded CVEs are caused by CWE-183 (Permissive List of Allowed Inputs). The highest-severity and most recent are shown first. 25 new CWE-183 CVEs have been recorded so far in 2026 (1 in 2025).

Showing 12 of 38 recorded CWE-183 CVEs. Track new ones as they are published and get AI-written analysis and fixes.

Monitor CWE-183 vulnerabilities

Common consequences

What can happen when CWE-183 is exploited.

Bypass Protection Mechanism

Affects: Access Control

How it happens

When it is introduced

Typically introduced during these phases of the software lifecycle.

Implementation

How to detect it

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

Effectiveness: High

Illustrative examples

Real CVEs that MITRE cites as examples of this weakness.

CVE-2019-12799 — chain: bypass of untrusted deserialization issue (CWE-502) by using an assumed-trusted class (CWE-183)
CVE-2019-10458 — sandbox bypass using a method that is on an allowlist
CVE-2017-1000095 — sandbox bypass using unsafe methods that are on an allowlist
CVE-2019-10458 — CI/CD pipeline feature has unsafe elements in allowlist, allowing bypass of script restrictions
CVE-2017-1000095 — Default allowlist includes unsafe methods, allowing bypass of sandbox

Terminology & mappings

Alternate terms

Allowlist / Allow List: This is used by CWE and CAPEC instead of other commonly-used terms. Its counterpart is denylist.
Safelist / Safe List: This is often used by security tools such as firewalls, email or web gateways, proxies, etc.
Whitelist / White List: This term is frequently used, but usage has been declining as organizations have started to adopt other terms.

Mapped taxonomies

PLOVER: Permissive Whitelist

Attack patterns

CAPEC attack patterns that exploit this weakness.

Frequently asked questions

Common questions about CWE-183.

What is CWE-183?: The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
What CVEs are caused by CWE-183?: 38 recorded CVEs are attributed to CWE-183, including CVE-2026-3490, CVE-2026-42043, CVE-2025-53762.
How is CWE-183 detected?: Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
What are the consequences of CWE-183?: Exploiting CWE-183 can lead to: Bypass Protection Mechanism.
Is CWE-183 actively exploited?: 38 recorded CVEs are caused by CWE-183; none are currently in CISA's KEV catalog of actively exploited flaws.

References

Weakness data is sourced from the MITRE CWE catalog (v4.20). CVE associations are aggregated and kept current by RadicalNotion.AI.

Stay ahead of CWE-183

Get alerted the moment a new CWE-183 vulnerability affects your stack, with AI-written analysis, severity context, and remediation guidance.

Start free See pricing