CWE-671: Lack of Administrator Control over Security
The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
Last updated
Overview
If the product's administrator does not have the ability to manage security-related decisions at all times, then protecting the product from outside threats - including the product's developer - can become impossible. For example, a hard-coded account name and password cannot be changed by the administrator, thus exposing that product to attacks that the administrator can not prevent.
Real-world CVEs
5 recorded CVEs are caused by CWE-671 (Lack of Administrator Control over Security). The highest-severity and most recent are shown first. 1 new CWE-671 CVE has been recorded so far in 2026 (1 in 2025).
- CVE-2025-24024
Mjolnir v1.9.0 accepts commands from any room
Critical · CVSS 9.1 · EPSS 44th2025-01-21 - CVE-2018-13283High · CVSS 8.8 · EPSS 69th2019-04-01
- CVE-2026-31985
Disabled and non-configurable TLS certificate validation in n2os-tui when connecting the Remote Collector to a Guardian or CMC, in Remote Collector before v26.2.0