Weaknesses of type CWE-284

7,121 results

Controle de acesso inadequado a recursos

A aplicação falha em validar ou impõe regras insuficientes para determinar quem pode acessar um recurso (arquivo, API, dados, funcionalidade). Um usuário não autorizado consegue contornar essas restrições e acessar o que não deveria, seja por falta de autenticação, autorização fraca ou lógica de controle de acesso bugada.

Example

Um sistema de gestão de RH permite que qualquer funcionário logado acesse `/api/salarios/{id}` substituindo o ID na URL. Sem verificar se o usuário é gestor ou RH, a API retorna dados salariais de qualquer pessoa da empresa. Um dev junior consegue ver quanto ganha o CTO.

How to mitigate

Implemente verificação explícita de permissões antes de qualquer acesso: confirme autenticação (quem é), autorização (o que pode fazer) e aplique o princípio do menor privilégio. Use listas de controle de acesso (ACL), roles bem definidos e sempre valide no backend, nunca confie em dados do cliente.

CVE-2023-39973—Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2025-28104CRITICALIncorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.EPSS 0.4%CVE-2023-32572MEDIUMFlashArray pgroup Retention Lock SafeMode ProtectionEPSS 0.4%CVE-2026-19210MEDIUMSourceCodester Photo Share Website ajax.php save_upload unrestricted uploadEPSS 0.4%CVE-2025-1590MEDIUMSourceCodester E-Learning System List of Lessons Page index.php unrestricted uploadEPSS 0.4%CVE-2026-46788HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that EPSS 0.4%CVE-2023-39972—Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3EPSS 0.4%CVE-2026-5863HIGHInappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandEPSS 0.4%CVE-2025-11136MEDIUMYiFang CMS Backend File.php webUploader unrestricted uploadEPSS 0.4%CVE-2026-44341MEDIUMGoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval EndpointEPSS 0.4%CVE-2025-7880MEDIUMMetasoft 美特软件 MetaCRM sendsms.jsp unrestricted uploadEPSS 0.4%CVE-2026-40474HIGHwger has Broken Access Control in the Global Gym Configuration Update EndpointEPSS 0.4%CVE-2026-26417HIGHA broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows autheEPSS 0.4%CVE-2025-7895MEDIUMharry0703 MoneyPrinterTurbo File Extension video.py upload_bgm_file unrestricted uploadEPSS 0.4%CVE-2026-20073MEDIUMCisco Secure Firewall Adaptive Security Appliance Software and Cisco Secure Firewall Threat Defense Software Access Control List Bypass VulnerabilityEPSS 0.4%CVE-2019-1601HIGHCisco NX-OS Software Unauthorized Filesystem Access VulnerabilityEPSS 0.4%CVE-2026-76995MEDIUMSourceCodester Simple Online Food Ordering System ajax.php save_menu unrestricted uploadEPSS 0.4%CVE-2025-11354MEDIUMcode-projects Online Hotel Reservation System addslideexec.php unrestricted uploadEPSS 0.4%CVE-2026-47049MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). Supported versions thEPSS 0.4%CVE-2026-15539MEDIUMSourceCodester Online Book Store System Book Image Upload Feature index.php books unrestricted uploadEPSS 0.4%