Weaknesses of type CWE-284

7,095 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2026-90603MEDIUMAnil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted uploadEPSS 0.5%CVE-2024-58330HIGHA missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analyticEPSS 0.5%CVE-2026-47261HIGHWasmtime: WASI path_open(TRUNCATE) bypasses `FilePerms::WRITE` host restrictionEPSS 0.5%CVE-2026-18788MEDIUMTrippo ResponsiveFilemanager dialog.php unrestricted uploadEPSS 0.5%CVE-2024-20373MEDIUMCisco IOS and Cisco IOS XE SNMP Extended ACL Bypass VulnerabilityEPSS 0.5%CVE-2025-3410MEDIUMmymagicpower AIAS LocalStorageController.java unrestricted uploadEPSS 0.5%CVE-2024-23446MEDIUMKibana Broken Access Control issueEPSS 0.5%CVE-2025-3830MEDIUMkuangstudy KuangSimpleBBS QuestionController.java fileUpload unrestricted uploadEPSS 0.5%CVE-2026-15488MEDIUMhcr707305003 shiroiAdmin FileController.php upload unrestricted uploadEPSS 0.5%CVE-2023-51786CRITICALAn issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sensEPSS 0.5%CVE-2025-2280HIGHImproper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to EPSS 0.5%CVE-2025-6873MEDIUMSourceCodester Simple Company Website Users.php unrestricted uploadEPSS 0.5%CVE-2025-6872MEDIUMSourceCodester Simple Company Website SystemSettings.php unrestricted uploadEPSS 0.5%CVE-2024-29839HIGHBroken Access control on DESKTOP_EDIT_USER_GET_CARD in Evolution Controller allows unauthenticated attackers to retrieve card data values.EPSS 0.5%CVE-2026-18776CRITICALTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Account Takeover via Multiple AJAX ActionsEPSS 0.5%CVE-2024-29840HIGHBroken Access control on DESKTOP_EDIT_USER_GET_PIN_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve PIN field valuesEPSS 0.5%CVE-2024-29843HIGHBroken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumerationEPSS 0.5%CVE-2026-66494HIGHJoomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0EPSS 0.5%CVE-2024-29841HIGHBroken Access control on DESKTOP_EDIT_USER_GET_KEYS_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve keys values EPSS 0.5%CVE-2024-29842HIGHBroken Access control on DESKTOP_EDIT_USER_GET_ABACARD_FIELDS in Evolution Controller allows unauthenticated attackers to retrieve ABACARD values EPSS 0.5%