CWE-767 applies when the product defines a public method that reads or modifies a private variable. The field looks protected, but the method is an open door to it.
MITRE lists C++, C# and Java as the affected languages, so this is a standard object oriented slip.
How it happens
Developers add a getter and setter to every field by habit. For a harmless field that is fine. For a critical one, such as a role, a price or a limit, the setter lets any caller overwrite it with no validation.
// Vulnerable: any caller can set the role to anything
public class Account {
private String role = "user";
public void setRole(String role) { this.role = role; }
}
What an attacker gains
MITRE records integrity as the main impact. If an attacker can set the variable to unexpected values, that violates assumptions elsewhere in the code. If they can read it, sensitive information may be exposed or follow-up attacks may get easier.
How to find it
Search for public setters and getters on fields that hold security decisions. Static analysis can list public methods that write to private state, but a person has to decide which fields are critical.
How to fix it
Use accessor and mutator methods appropriately. Validate data accepted by a public method that changes a critical private variable, and apply access controls whenever a public method touches critical data.
// Fix: no setter; change goes through a checked method
public void promote(Admin caller, String newRole) {
if (!caller.canGrant(newRole)) throw new SecurityException();
this.role = newRole;
}
Quick check
Is a private field safe by itself?
No. Safety depends on every method that can reach it. A public setter with no checks makes the field effectively public.
