Which CVSSv3 metric captures the level of access that is required for a successful attack?

Attack Vector describes the context or network path by which exploitation is possible (Network, Adjacent, Local, or Physical), not the privilege or access level the attacker must hold.

Attack Complexity captures conditions beyond the attacker's direct control that must exist for exploitation to succeed, such as race conditions or specific configurations, not the required privilege level.

The Privileges Required metric in CVSSv3 describes the level of privileges an attacker must possess before successfully exploiting the vulnerability, with enumerated values of None, Low, or High. This metric directly captures required access level - for example, a vulnerability exploitable without any authentication scores None, while one requiring administrative credentials scores High.

User Interaction indicates whether a victim user must actively participate in the compromise for the attack to succeed, not the attacker's own privilege or access level.