Weaknesses of type CWE-284

7,101 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2025-21340MEDIUMWindows Virtualization-Based Security (VBS) Security Feature Bypass VulnerabilityEPSS 0.5%CVE-2026-65613MEDIUMApache CloudStack: Webhook Deliveries Incorrect AccessEPSS 0.5%CVE-2024-1492MEDIUMWPify Woo Czech <= 4.0.8 - Missing AuthorizationEPSS 0.5%CVE-2025-5059MEDIUMCampcodes Online Shopping Portal edit-subcategory.php unrestricted uploadEPSS 0.5%CVE-2026-24690HIGHGitea pull-request branch updates use insufficient permission checksEPSS 0.5%CVE-2026-27660HIGHGitea draft releases use insufficient permission checksEPSS 0.5%CVE-2025-32726MEDIUMVisual Studio Code Elevation of Privilege VulnerabilityEPSS 0.5%CVE-2025-39247HIGHThere is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the adEPSS 0.5%CVE-2025-61777CRITICALFlagForge Allows Unauthenticated Badge Template API AccessEPSS 0.5%CVE-2025-46608CRITICALDell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote EPSS 0.5%CVE-2025-4926MEDIUMPHPGurukul Car Rental Project post-avehical.php unrestricted uploadEPSS 0.5%CVE-2022-1959MEDIUMAppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because thEPSS 0.5%CVE-2020-3231MEDIUMCisco IOS Software for Catalyst 2960-L Series Switches and Catalyst CDB-8P Switches 802.1X Authentication Bypass VulnerabilityEPSS 0.5%CVE-2025-7547MEDIUMCampcodes Online Movie Theater Seat Reservation System admin_class.php save_movie unrestricted uploadEPSS 0.5%CVE-2025-2705MEDIUMDigiwin ERP FileUploadApi.ashx DoWebUpload unrestricted uploadEPSS 0.4%CVE-2024-20263MEDIUMA vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart SwitcEPSS 0.4%CVE-2021-24801—WP Survey Plus <= 1.0 - Subscriber+ AJAX CallsEPSS 0.4%CVE-2024-1092MEDIUMRSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 4.4.1 - Missing AuthorizationEPSS 0.4%CVE-2023-36820MEDIUMmicronaut security has invalid IdTokenClaimsValidator logic on audEPSS 0.4%CVE-2018-17908—WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it afEPSS 0.4%