Weaknesses of type CWE-284

7,111 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2026-71807MEDIUMIn RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and theEPSS 0.4%CVE-2024-28969MEDIUMDell SCG, versions prior to 5.24.00.00, contain an Improper Access Control vulnerability in the SCG exposed for an internal update REST API EPSS 0.4%CVE-2018-4844—A vulnerability has been identified in SIMATIC WinCC OA UI for Android (All versions < V3.15.10), SIMATIC WinCC OA UI for iOS (All versions EPSS 0.4%CVE-2026-20304CRITICALCisco Catalyst SD-WAN Security Hardening Release - Access Control VulnerabilitiesEPSS 0.4%CVE-2024-0369MEDIUMBulk Edit Post Titles <= 5.0.0 - Missing Authorization via bulkUpdatePostTitlesEPSS 0.4%CVE-2026-20150HIGHCisco RoomOS Security Hardening Release - Access Control VulnerabilitiesEPSS 0.4%CVE-2025-7755MEDIUMcode-projects Online Ordering System edit_product.php unrestricted uploadEPSS 0.4%CVE-2026-87233HIGHVulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is EPSS 0.4%CVE-2024-33647MEDIUMA vulnerability has been identified in Polarion ALM (All versions < V2404.0). The Apache Lucene based query engine in the affected applicatiEPSS 0.4%CVE-2024-39701MEDIUMDirectus Incorrectly handles _in` filterEPSS 0.4%CVE-2026-48957MEDIUMJoomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpointsEPSS 0.4%CVE-2026-48948MEDIUMJoomla! Core - [20260702] - Incorrect Access Control in com_contact vcf downloadEPSS 0.4%CVE-2025-55469CRITICALIncorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.EPSS 0.4%CVE-2025-8256MEDIUMcode-projects Online Ordering System product.php unrestricted uploadEPSS 0.4%CVE-2024-57157CRITICALIncorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token.EPSS 0.4%CVE-2021-24752—Multiple Plugins from CatchThemes - Unauthorised Plugin's Setting ChangeEPSS 0.4%CVE-2026-30994HIGHIncorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive informatiEPSS 0.4%CVE-2025-23083HIGHWith the aid of the diagnostics_channel utility, an event can be hooked into whenever a worker thread is created. This is not limited only tEPSS 0.4%CVE-2025-11398MEDIUMSourceCodester Hotel and Lodge Management System Profile profile.php unrestricted uploadEPSS 0.4%CVE-2024-57154CRITICALIncorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/EPSS 0.4%