Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it, generally, considered to be a security issue if a user in 3-tier application has read-only access to other users' permissions? I.e. Alice can see that Bob has or has not access to some resource.

share|improve this question
up vote 6 down vote accepted

Potentially, sure.

If permissions are viewable, that gives an attacker a list of valid usernames and tells the attacker which accounts are the best candidates to attack. An attacker is much more likely to want to break in to the jdoe account in the HR system if they know, for example, that jdoe has the ability to see everyone's salary.

Making permissions viewable also makes it much more likely that other security shortcomings are going to be exploited. If someone forgot to remove the jdoe account when he was fired, for example, or if someone inadvertently assigned privileges to jdoe rather than janedoe, viewable privileges lets the attacker see immediately where the weak points are and figure out how to craft an attack to stop it.

Of course, the attacker still has to craft an appropriate attack-- whether technical or social-- to exploit the information they get from being able to view other users' privileges. It just makes it quicker, easier, and safer to mount the attack if you know where the pressure points are.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.