Join our Newsletter — 33% off our NHI Course

Not Using Complete Mediation

Not using complete mediation means a system does not recheck every access to a resource, instead relying on a previous decision, cached state, or one-time check. Attackers abuse stale authorisation and race conditions to gain unintended access. Defenders should verify permissions at each sensitive operation and invalidate assumptions when context changes.

What It Means When Access Is Checked Only Once

Not using complete mediation is a control failure, not just a coding shortcut. The system trusts a prior decision instead of revalidating authority at the point of use, so permission can drift away from the actual state of the resource, session, or user context.

This weakens the core security assumption that access decisions remain valid over time. Once the original check becomes stale, any later change in ownership, role, session state, or object state can leave a dangerous gap between what the application believes and what should be allowed.

Why Stale Decisions Become Dangerous

The main risk is that attackers can exploit timing gaps, cached authorisation, or repeated use of an old decision to reach something they should no longer be able to access. That is why this weakness is often associated with race conditions and time-of-check, time-of-use style failures.

In practice, the danger grows when the protected operation is sensitive, high value, or hard to monitor. If a system reuses a previous allow decision, the attacker only needs one moment of weakness, then can act before the defender’s assumptions are refreshed. The CWE Top 25 Guide is useful background because it groups not using complete mediation with other high-impact software weaknesses, including race-condition and authorisation flaws.

Where It Usually Shows Up

This flaw appears wherever an application separates the permission check from the actual sensitive action. Common examples include cached session decisions, reused object handles, stale role information, client-assisted state, and workflows that trust an earlier validation step for too long.

It is especially problematic when the resource state can change quickly, such as after revocation, reassignment, approval, expiry, or concurrent update. Any design that assumes “checked once means safe forever” creates a brittle trust boundary that attackers can target.

How Defenders Reduce the Exposure

Defensive design should bind authorisation to the exact sensitive operation, not to an earlier moment in the workflow. Recheck permissions when the resource is accessed, invalidate cached assumptions when context changes, and treat revocation, ownership changes, and workflow transitions as events that can invalidate prior trust.

Operationally, this means reviewers should look for reused decisions, stale state, and concurrency windows in code paths that expose sensitive data or actions. The CISA Known Exploited Vulnerabilities Catalog is also relevant as a reminder that widely exploited weaknesses often persist because the underlying exposure is not fully removed, only partially patched.

For control design, NIST Cybersecurity Framework 2.0 supports this kind of discipline through governance, protection, detection, and response expectations that favour continuous validation over one-time trust.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework Control / Reference Relevance
OWASP ASVS V8 — Authorization Complete mediation is an authorization enforcement concern at the point of use.
V7 — Session Management Stale sessions and cached state can preserve access after the underlying context changes.
Recommendation — Enforce authorization at each sensitive operation instead of relying on earlier checks. Invalidate or rebind sessions when authorization context changes.
CIS Controls v8 CIS-6 — Access Control Management This weakness creates lingering access that should be revoked or revalidated through access management.
Recommendation — Review and revoke stale access paths that survive beyond their intended authorization state.
NIST SP 800-53 Rev 5 AC-3 — Access Enforcement Access enforcement must occur when the resource is used, not only at an earlier decision point.
AC-12 — Session Termination Stale sessions can preserve rights after the context that justified them has changed.
Recommendation — Apply access enforcement at the point of each protected operation. Terminate or revalidate sessions when the access context is no longer current.